assigned 3 more CVEs.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

12 files changed, 688 insertions, 0 deletions

diff --git a/cve/reserved/2024/CVE-2024-26923 b/cve/published/2024/CVE-2024-26923
index e69de29b..e69de29b 100644
--- a/cve/reserved/2024/CVE-2024-26923
+++ b/cve/published/2024/CVE-2024-26923
diff --git a/cve/published/2024/CVE-2024-26923.json b/cve/published/2024/CVE-2024-26923.json
new file mode 100644
index 00000000..5f369f19
--- /dev/null
+++ b/cve/published/2024/CVE-2024-26923.json
@@ -0,0 +1,133 @@
+{
+   "containers": {
+      "cna": {
+         "providerMetadata": {
+            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
+         },
+         "descriptions": [
+            {
+               "lang": "en",
+               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Fix garbage collector racing against connect()\n\nGarbage collector does not take into account the risk of embryo getting\nenqueued during the garbage collection. If such embryo has a peer that\ncarries SCM_RIGHTS, two consecutive passes of scan_children() may see a\ndifferent set of children. Leading to an incorrectly elevated inflight\ncount, and then a dangling pointer within the gc_inflight_list.\n\nsockets are AF_UNIX/SOCK_STREAM\nS is an unconnected socket\nL is a listening in-flight socket bound to addr, not in fdtable\nV's fd will be passed via sendmsg(), gets inflight count bumped\n\nconnect(S, addr)\tsendmsg(S, [V]); close(V)\t__unix_gc()\n----------------\t-------------------------\t-----------\n\nNS = unix_create1()\nskb1 = sock_wmalloc(NS)\nL = unix_find_other(addr)\nunix_state_lock(L)\nunix_peer(S) = NS\n\t\t\t// V count=1 inflight=0\n\n \t\t\tNS = unix_peer(S)\n \t\t\tskb2 = sock_alloc()\n\t\t\tskb_queue_tail(NS, skb2[V])\n\n\t\t\t// V became in-flight\n\t\t\t// V count=2 inflight=1\n\n\t\t\tclose(V)\n\n\t\t\t// V count=1 inflight=1\n\t\t\t// GC candidate condition met\n\n\t\t\t\t\t\tfor u in gc_inflight_list:\n\t\t\t\t\t\t  if (total_refs == inflight_refs)\n\t\t\t\t\t\t    add u to gc_candidates\n\n\t\t\t\t\t\t// gc_candidates={L, V}\n\n\t\t\t\t\t\tfor u in gc_candidates:\n\t\t\t\t\t\t  scan_children(u, dec_inflight)\n\n\t\t\t\t\t\t// embryo (skb1) was not\n\t\t\t\t\t\t// reachable from L yet, so V's\n\t\t\t\t\t\t// inflight remains unchanged\n__skb_queue_tail(L, skb1)\nunix_state_unlock(L)\n\t\t\t\t\t\tfor u in gc_candidates:\n\t\t\t\t\t\t  if (u.inflight)\n\t\t\t\t\t\t    scan_children(u, inc_inflight_move_tail)\n\n\t\t\t\t\t\t// V count=1 inflight=2 (!)\n\nIf there is a GC-candidate listening socket, lock/unlock its state. This\nmakes GC wait until the end of any ongoing connect() to that socket. After\nflipping the lock, a possibly SCM-laden embryo is already enqueued. And if\nthere is another embryo coming, it can not possibly carry SCM_RIGHTS. At\nthis point, unix_inflight() can not happen because unix_gc_lock is already\ntaken. Inflight graph remains unaffected."
+            }
+         ],
+         "affected": [
+            {
+               "product": "Linux",
+               "vendor": "Linux",
+               "defaultStatus": "unaffected",
+               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
+               "versions": [
+                  {
+                     "version": "1fd05ba5a2f2",
+                     "lessThan": "e76c2678228f",
+                     "status": "affected",
+                     "versionType": "git"
+                  },
+                  {
+                     "version": "1fd05ba5a2f2",
+                     "lessThan": "b75722be422c",
+                     "status": "affected",
+                     "versionType": "git"
+                  },
+                  {
+                     "version": "1fd05ba5a2f2",
+                     "lessThan": "507cc232ffe5",
+                     "status": "affected",
+                     "versionType": "git"
+                  },
+                  {
+                     "version": "1fd05ba5a2f2",
+                     "lessThan": "dbdf7bec5c92",
+                     "status": "affected",
+                     "versionType": "git"
+                  },
+                  {
+                     "version": "1fd05ba5a2f2",
+                     "lessThan": "47d8ac011fe1",
+                     "status": "affected",
+                     "versionType": "git"
+                  }
+               ]
+            },
+            {
+               "product": "Linux",
+               "vendor": "Linux",
+               "defaultStatus": "affected",
+               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
+               "versions": [
+                  {
+                     "version": "2.6.23",
+                     "status": "affected"
+                  },
+                  {
+                     "version": "0",
+                     "lessThan": "2.6.23",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "5.15.156",
+                     "lessThanOrEqual": "5.15.*",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "6.1.87",
+                     "lessThanOrEqual": "6.1.*",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "6.6.28",
+                     "lessThanOrEqual": "6.6.*",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "6.8.7",
+                     "lessThanOrEqual": "6.8.*",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "6.9-rc4",
+                     "lessThanOrEqual": "*",
+                     "status": "unaffected",
+                     "versionType": "original_commit_for_fix"
+                  }
+               ]
+            }
+         ],
+         "references": [
+            {
+               "url": "https://git.kernel.org/stable/c/e76c2678228f6aec74b305ae30c9374cc2f28a51"
+            },
+            {
+               "url": "https://git.kernel.org/stable/c/b75722be422c276b699200de90527d01c602ea7c"
+            },
+            {
+               "url": "https://git.kernel.org/stable/c/507cc232ffe53a352847893f8177d276c3b532a9"
+            },
+            {
+               "url": "https://git.kernel.org/stable/c/dbdf7bec5c920200077d693193f989cb1513f009"
+            },
+            {
+               "url": "https://git.kernel.org/stable/c/47d8ac011fe1c9251070e1bd64cb10b48193ec51"
+            }
+         ],
+         "title": "af_unix: Fix garbage collector racing against connect()",
+         "x_generator": {
+            "engine": "bippy-d175d3acf727"
+         }
+      }
+   },
+   "cveMetadata": {
+      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
+      "cveID": "CVE-2024-26923",
+      "requesterUserId": "gregkh@kernel.org",
+      "serial": "1",
+      "state": "PUBLISHED"
+   },
+   "dataType": "CVE_RECORD",
+   "dataVersion": "5.0"
+}
diff --git a/cve/published/2024/CVE-2024-26923.mbox b/cve/published/2024/CVE-2024-26923.mbox
new file mode 100644
index 00000000..4122cd3a
--- /dev/null
+++ b/cve/published/2024/CVE-2024-26923.mbox
@@ -0,0 +1,128 @@
+From bippy-d175d3acf727 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+To: <linux-cve-announce@vger.kernel.org>
+Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
+Subject: CVE-2024-26923: af_unix: Fix garbage collector racing against connect()
+Message-Id: <2024042418-CVE-2024-26923-f7f6@gregkh>
+Content-Length: 4025
+Lines: 111
+X-Developer-Signature: v=1; a=openpgp-sha256; l=4137;
+ i=gregkh@linuxfoundation.org; h=from:subject:message-id;
+ bh=ANssXhZgfzUaH08i5lrOWu8DaZ7QVrgeoD4X8irpiMk=;
+ b=owGbwMvMwCRo6H6F97bub03G02pJDGmadXHMfR8kNKYlVZ+9HPPvc29pXkaxseHrtw6eEWceF
+ 3re8frSEcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABOxSmeYw6Mfz59hce379gQh
+ aZ+uyAmi7znlGOZHlbM/yVFZERb8dU/ZFI34gGZx94sA
+X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp;
+ fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29
+
+Description
+===========
+
+In the Linux kernel, the following vulnerability has been resolved:
+
+af_unix: Fix garbage collector racing against connect()
+
+Garbage collector does not take into account the risk of embryo getting
+enqueued during the garbage collection. If such embryo has a peer that
+carries SCM_RIGHTS, two consecutive passes of scan_children() may see a
+different set of children. Leading to an incorrectly elevated inflight
+count, and then a dangling pointer within the gc_inflight_list.
+
+sockets are AF_UNIX/SOCK_STREAM
+S is an unconnected socket
+L is a listening in-flight socket bound to addr, not in fdtable
+V's fd will be passed via sendmsg(), gets inflight count bumped
+
+connect(S, addr)	sendmsg(S, [V]); close(V)	__unix_gc()
+----------------	-------------------------	-----------
+
+NS = unix_create1()
+skb1 = sock_wmalloc(NS)
+L = unix_find_other(addr)
+unix_state_lock(L)
+unix_peer(S) = NS
+			// V count=1 inflight=0
+
+ 			NS = unix_peer(S)
+ 			skb2 = sock_alloc()
+			skb_queue_tail(NS, skb2[V])
+
+			// V became in-flight
+			// V count=2 inflight=1
+
+			close(V)
+
+			// V count=1 inflight=1
+			// GC candidate condition met
+
+						for u in gc_inflight_list:
+						  if (total_refs == inflight_refs)
+						    add u to gc_candidates
+
+						// gc_candidates={L, V}
+
+						for u in gc_candidates:
+						  scan_children(u, dec_inflight)
+
+						// embryo (skb1) was not
+						// reachable from L yet, so V's
+						// inflight remains unchanged
+__skb_queue_tail(L, skb1)
+unix_state_unlock(L)
+						for u in gc_candidates:
+						  if (u.inflight)
+						    scan_children(u, inc_inflight_move_tail)
+
+						// V count=1 inflight=2 (!)
+
+If there is a GC-candidate listening socket, lock/unlock its state. This
+makes GC wait until the end of any ongoing connect() to that socket. After
+flipping the lock, a possibly SCM-laden embryo is already enqueued. And if
+there is another embryo coming, it can not possibly carry SCM_RIGHTS. At
+this point, unix_inflight() can not happen because unix_gc_lock is already
+taken. Inflight graph remains unaffected.
+
+The Linux kernel CVE team has assigned CVE-2024-26923 to this issue.
+
+
+Affected and fixed versions
+===========================
+
+	Issue introduced in 2.6.23 with commit 1fd05ba5a2f2 and fixed in 5.15.156 with commit e76c2678228f
+	Issue introduced in 2.6.23 with commit 1fd05ba5a2f2 and fixed in 6.1.87 with commit b75722be422c
+	Issue introduced in 2.6.23 with commit 1fd05ba5a2f2 and fixed in 6.6.28 with commit 507cc232ffe5
+	Issue introduced in 2.6.23 with commit 1fd05ba5a2f2 and fixed in 6.8.7 with commit dbdf7bec5c92
+	Issue introduced in 2.6.23 with commit 1fd05ba5a2f2 and fixed in 6.9-rc4 with commit 47d8ac011fe1
+
+Please see https://www.kernel.org for a full list of currently supported
+kernel versions by the kernel community.
+
+Unaffected versions might change over time as fixes are backported to
+older supported kernel versions.  The official CVE entry at
+	https://cve.org/CVERecord/?id=CVE-2024-26923
+will be updated if fixes are backported, please check that for the most
+up to date information about this issue.
+
+
+Affected files
+==============
+
+The file(s) affected by this issue are:
+	net/unix/garbage.c
+
+
+Mitigation
+==========
+
+The Linux kernel CVE team recommends that you update to the latest
+stable kernel version for this, and many other bugfixes.  Individual
+changes are never tested alone, but rather are part of a larger kernel
+release.  Cherry-picking individual commits is not recommended or
+supported by the Linux kernel community at all.  If however, updating to
+the latest release is impossible, the individual changes to resolve this
+issue can be found at these commits:
+	https://git.kernel.org/stable/c/e76c2678228f6aec74b305ae30c9374cc2f28a51
+	https://git.kernel.org/stable/c/b75722be422c276b699200de90527d01c602ea7c
+	https://git.kernel.org/stable/c/507cc232ffe53a352847893f8177d276c3b532a9
+	https://git.kernel.org/stable/c/dbdf7bec5c920200077d693193f989cb1513f009
+	https://git.kernel.org/stable/c/47d8ac011fe1c9251070e1bd64cb10b48193ec51
diff --git a/cve/published/2024/CVE-2024-26923.sha1 b/cve/published/2024/CVE-2024-26923.sha1
new file mode 100644
index 00000000..9423fe0d
--- /dev/null
+++ b/cve/published/2024/CVE-2024-26923.sha1
@@ -0,0 +1 @@
+47d8ac011fe1c9251070e1bd64cb10b48193ec51
diff --git a/cve/reserved/2024/CVE-2024-26924 b/cve/published/2024/CVE-2024-26924
index e69de29b..e69de29b 100644
--- a/cve/reserved/2024/CVE-2024-26924
+++ b/cve/published/2024/CVE-2024-26924
diff --git a/cve/published/2024/CVE-2024-26924.json b/cve/published/2024/CVE-2024-26924.json
new file mode 100644
index 00000000..35a3b3f7
--- /dev/null
+++ b/cve/published/2024/CVE-2024-26924.json
@@ -0,0 +1,73 @@
+{
+   "containers": {
+      "cna": {
+         "providerMetadata": {
+            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
+         },
+         "descriptions": [
+            {
+               "lang": "en",
+               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: do not free live element\n\nPablo reports a crash with large batches of elements with a\nback-to-back add/remove pattern.  Quoting Pablo:\n\n  add_elem(\"00000000\") timeout 100 ms\n  ...\n  add_elem(\"0000000X\") timeout 100 ms\n  del_elem(\"0000000X\") <---------------- delete one that was just added\n  ...\n  add_elem(\"00005000\") timeout 100 ms\n\n  1) nft_pipapo_remove() removes element 0000000X\n  Then, KASAN shows a splat.\n\nLooking at the remove function there is a chance that we will drop a\nrule that maps to a non-deactivated element.\n\nRemoval happens in two steps, first we do a lookup for key k and return the\nto-be-removed element and mark it as inactive in the next generation.\nThen, in a second step, the element gets removed from the set/map.\n\nThe _remove function does not work correctly if we have more than one\nelement that share the same key.\n\nThis can happen if we insert an element into a set when the set already\nholds an element with same key, but the element mapping to the existing\nkey has timed out or is not active in the next generation.\n\nIn such case its possible that removal will unmap the wrong element.\nIf this happens, we will leak the non-deactivated element, it becomes\nunreachable.\n\nThe element that got deactivated (and will be freed later) will\nremain reachable in the set data structure, this can result in\na crash when such an element is retrieved during lookup (stale\npointer).\n\nAdd a check that the fully matching key does in fact map to the element\nthat we have marked as inactive in the deactivation step.\nIf not, we need to continue searching.\n\nAdd a bug/warn trap at the end of the function as well, the remove\nfunction must not ever be called with an invisible/unreachable/non-existent\nelement.\n\nv2: avoid uneeded temporary variable (Stefano)"
+            }
+         ],
+         "affected": [
+            {
+               "product": "Linux",
+               "vendor": "Linux",
+               "defaultStatus": "unaffected",
+               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
+               "versions": [
+                  {
+                     "version": "3c4287f62044",
+                     "lessThan": "3cfc9ec039af",
+                     "status": "affected",
+                     "versionType": "git"
+                  }
+               ]
+            },
+            {
+               "product": "Linux",
+               "vendor": "Linux",
+               "defaultStatus": "affected",
+               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
+               "versions": [
+                  {
+                     "version": "5.6",
+                     "status": "affected"
+                  },
+                  {
+                     "version": "0",
+                     "lessThan": "5.6",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "6.9-rc5",
+                     "lessThanOrEqual": "*",
+                     "status": "unaffected",
+                     "versionType": "original_commit_for_fix"
+                  }
+               ]
+            }
+         ],
+         "references": [
+            {
+               "url": "https://git.kernel.org/stable/c/3cfc9ec039af60dbd8965ae085b2c2ccdcfbe1cc"
+            }
+         ],
+         "title": "netfilter: nft_set_pipapo: do not free live element",
+         "x_generator": {
+            "engine": "bippy-d175d3acf727"
+         }
+      }
+   },
+   "cveMetadata": {
+      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
+      "cveID": "CVE-2024-26924",
+      "requesterUserId": "gregkh@kernel.org",
+      "serial": "1",
+      "state": "PUBLISHED"
+   },
+   "dataType": "CVE_RECORD",
+   "dataVersion": "5.0"
+}
diff --git a/cve/published/2024/CVE-2024-26924.mbox b/cve/published/2024/CVE-2024-26924.mbox
new file mode 100644
index 00000000..68ef6663
--- /dev/null
+++ b/cve/published/2024/CVE-2024-26924.mbox
@@ -0,0 +1,106 @@
+From bippy-d175d3acf727 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+To: <linux-cve-announce@vger.kernel.org>
+Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
+Subject: CVE-2024-26924: netfilter: nft_set_pipapo: do not free live element
+Message-Id: <2024042420-CVE-2024-26924-4d1e@gregkh>
+Content-Length: 3186
+Lines: 89
+X-Developer-Signature: v=1; a=openpgp-sha256; l=3276;
+ i=gregkh@linuxfoundation.org; h=from:subject:message-id;
+ bh=7USmLImAYgMUj3Pl3v+kzWuDNvJ1fJTy2gUjScReQlA=;
+ b=owGbwMvMwCRo6H6F97bub03G02pJDGmadQnlTw5s/bmgf/cU67ePVcQmeDduurNI1Hph7CrZq
+ Ur/VnUf64hlYRBkYpAVU2T5so3n6P6KQ4pehranYeawMoEMYeDiFICJHDRjmB+t8fHNoinq8570
+ 6aldY5Zn26Bgn8QwT8n4WdaMh3bzp+bYSB1UX6otdzCnCAA=
+X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp;
+ fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29
+
+Description
+===========
+
+In the Linux kernel, the following vulnerability has been resolved:
+
+netfilter: nft_set_pipapo: do not free live element
+
+Pablo reports a crash with large batches of elements with a
+back-to-back add/remove pattern.  Quoting Pablo:
+
+  add_elem("00000000") timeout 100 ms
+  ...
+  add_elem("0000000X") timeout 100 ms
+  del_elem("0000000X") <---------------- delete one that was just added
+  ...
+  add_elem("00005000") timeout 100 ms
+
+  1) nft_pipapo_remove() removes element 0000000X
+  Then, KASAN shows a splat.
+
+Looking at the remove function there is a chance that we will drop a
+rule that maps to a non-deactivated element.
+
+Removal happens in two steps, first we do a lookup for key k and return the
+to-be-removed element and mark it as inactive in the next generation.
+Then, in a second step, the element gets removed from the set/map.
+
+The _remove function does not work correctly if we have more than one
+element that share the same key.
+
+This can happen if we insert an element into a set when the set already
+holds an element with same key, but the element mapping to the existing
+key has timed out or is not active in the next generation.
+
+In such case its possible that removal will unmap the wrong element.
+If this happens, we will leak the non-deactivated element, it becomes
+unreachable.
+
+The element that got deactivated (and will be freed later) will
+remain reachable in the set data structure, this can result in
+a crash when such an element is retrieved during lookup (stale
+pointer).
+
+Add a check that the fully matching key does in fact map to the element
+that we have marked as inactive in the deactivation step.
+If not, we need to continue searching.
+
+Add a bug/warn trap at the end of the function as well, the remove
+function must not ever be called with an invisible/unreachable/non-existent
+element.
+
+v2: avoid uneeded temporary variable (Stefano)
+
+The Linux kernel CVE team has assigned CVE-2024-26924 to this issue.
+
+
+Affected and fixed versions
+===========================
+
+	Issue introduced in 5.6 with commit 3c4287f62044 and fixed in 6.9-rc5 with commit 3cfc9ec039af
+
+Please see https://www.kernel.org for a full list of currently supported
+kernel versions by the kernel community.
+
+Unaffected versions might change over time as fixes are backported to
+older supported kernel versions.  The official CVE entry at
+	https://cve.org/CVERecord/?id=CVE-2024-26924
+will be updated if fixes are backported, please check that for the most
+up to date information about this issue.
+
+
+Affected files
+==============
+
+The file(s) affected by this issue are:
+	net/netfilter/nft_set_pipapo.c
+
+
+Mitigation
+==========
+
+The Linux kernel CVE team recommends that you update to the latest
+stable kernel version for this, and many other bugfixes.  Individual
+changes are never tested alone, but rather are part of a larger kernel
+release.  Cherry-picking individual commits is not recommended or
+supported by the Linux kernel community at all.  If however, updating to
+the latest release is impossible, the individual changes to resolve this
+issue can be found at these commits:
+	https://git.kernel.org/stable/c/3cfc9ec039af60dbd8965ae085b2c2ccdcfbe1cc
diff --git a/cve/published/2024/CVE-2024-26924.sha1 b/cve/published/2024/CVE-2024-26924.sha1
new file mode 100644
index 00000000..fe51f8fc
--- /dev/null
+++ b/cve/published/2024/CVE-2024-26924.sha1
@@ -0,0 +1 @@
+3cfc9ec039af60dbd8965ae085b2c2ccdcfbe1cc
diff --git a/cve/reserved/2024/CVE-2024-26925 b/cve/published/2024/CVE-2024-26925
index e69de29b..e69de29b 100644
--- a/cve/reserved/2024/CVE-2024-26925
+++ b/cve/published/2024/CVE-2024-26925
diff --git a/cve/published/2024/CVE-2024-26925.json b/cve/published/2024/CVE-2024-26925.json
new file mode 100644
index 00000000..c39a7c25
--- /dev/null
+++ b/cve/published/2024/CVE-2024-26925.json
@@ -0,0 +1,163 @@
+{
+   "containers": {
+      "cna": {
+         "providerMetadata": {
+            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
+         },
+         "descriptions": [
+            {
+               "lang": "en",
+               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: release mutex after nft_gc_seq_end from abort path\n\nThe commit mutex should not be released during the critical section\nbetween nft_gc_seq_begin() and nft_gc_seq_end(), otherwise, async GC\nworker could collect expired objects and get the released commit lock\nwithin the same GC sequence.\n\nnf_tables_module_autoload() temporarily releases the mutex to load\nmodule dependencies, then it goes back to replay the transaction again.\nMove it at the end of the abort phase after nft_gc_seq_end() is called."
+            }
+         ],
+         "affected": [
+            {
+               "product": "Linux",
+               "vendor": "Linux",
+               "defaultStatus": "unaffected",
+               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
+               "versions": [
+                  {
+                     "version": "4b6346dc1edf",
+                     "lessThan": "61ac7284346c",
+                     "status": "affected",
+                     "versionType": "git"
+                  },
+                  {
+                     "version": "23292bdfda5f",
+                     "lessThan": "2cee2ff7f8cc",
+                     "status": "affected",
+                     "versionType": "git"
+                  },
+                  {
+                     "version": "b44a459c6561",
+                     "lessThan": "eb769ff4e281",
+                     "status": "affected",
+                     "versionType": "git"
+                  },
+                  {
+                     "version": "5d319f7a8143",
+                     "lessThan": "8d3a58af50e4",
+                     "status": "affected",
+                     "versionType": "git"
+                  },
+                  {
+                     "version": "720344340fb9",
+                     "lessThan": "8038ee3c3e5b",
+                     "status": "affected",
+                     "versionType": "git"
+                  },
+                  {
+                     "version": "720344340fb9",
+                     "lessThan": "a34ba4bdeec0",
+                     "status": "affected",
+                     "versionType": "git"
+                  },
+                  {
+                     "version": "720344340fb9",
+                     "lessThan": "0d459e2ffb54",
+                     "status": "affected",
+                     "versionType": "git"
+                  }
+               ]
+            },
+            {
+               "product": "Linux",
+               "vendor": "Linux",
+               "defaultStatus": "affected",
+               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
+               "versions": [
+                  {
+                     "version": "6.5",
+                     "status": "affected"
+                  },
+                  {
+                     "version": "0",
+                     "lessThan": "6.5",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "5.4.274",
+                     "lessThanOrEqual": "5.4.*",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "5.10.215",
+                     "lessThanOrEqual": "5.10.*",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "5.15.155",
+                     "lessThanOrEqual": "5.15.*",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "6.1.86",
+                     "lessThanOrEqual": "6.1.*",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "6.6.26",
+                     "lessThanOrEqual": "6.6.*",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "6.8.5",
+                     "lessThanOrEqual": "6.8.*",
+                     "status": "unaffected",
+                     "versionType": "custom"
+                  },
+                  {
+                     "version": "6.9-rc3",
+                     "lessThanOrEqual": "*",
+                     "status": "unaffected",
+                     "versionType": "original_commit_for_fix"
+                  }
+               ]
+            }
+         ],
+         "references": [
+            {
+               "url": "https://git.kernel.org/stable/c/61ac7284346c32f9a8c8ceac56102f7914060428"
+            },
+            {
+               "url": "https://git.kernel.org/stable/c/2cee2ff7f8cce12a63a0a23ffe27f08d99541494"
+            },
+            {
+               "url": "https://git.kernel.org/stable/c/eb769ff4e281f751adcaf4f4445cbf30817be139"
+            },
+            {
+               "url": "https://git.kernel.org/stable/c/8d3a58af50e46167b6f1db47adadad03c0045dae"
+            },
+            {
+               "url": "https://git.kernel.org/stable/c/8038ee3c3e5b59bcd78467686db5270c68544e30"
+            },
+            {
+               "url": "https://git.kernel.org/stable/c/a34ba4bdeec0c3b629160497594908dc820110f1"
+            },
+            {
+               "url": "https://git.kernel.org/stable/c/0d459e2ffb541841714839e8228b845458ed3b27"
+            }
+         ],
+         "title": "netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path",
+         "x_generator": {
+            "engine": "bippy-d175d3acf727"
+         }
+      }
+   },
+   "cveMetadata": {
+      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
+      "cveID": "CVE-2024-26925",
+      "requesterUserId": "gregkh@kernel.org",
+      "serial": "1",
+      "state": "PUBLISHED"
+   },
+   "dataType": "CVE_RECORD",
+   "dataVersion": "5.0"
+}
diff --git a/cve/published/2024/CVE-2024-26925.mbox b/cve/published/2024/CVE-2024-26925.mbox
new file mode 100644
index 00000000..6d71afa0
--- /dev/null
+++ b/cve/published/2024/CVE-2024-26925.mbox
@@ -0,0 +1,82 @@
+From bippy-d175d3acf727 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+To: <linux-cve-announce@vger.kernel.org>
+Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
+Subject: CVE-2024-26925: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
+Message-Id: <2024042421-CVE-2024-26925-7c19@gregkh>
+Content-Length: 2992
+Lines: 65
+X-Developer-Signature: v=1; a=openpgp-sha256; l=3058;
+ i=gregkh@linuxfoundation.org; h=from:subject:message-id;
+ bh=VzQ5ZUBdMjHT0EjKDWIhhGkQP+dMPiqHZKhG0zo2QeM=;
+ b=owGbwMvMwCRo6H6F97bub03G02pJDGmadYmmn4P2zZ45U69GfWnkfLP5KwospPTr2tgV9Vavz
+ lXTW97ZEcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABN5F8kwm3WRq9x+FefQH6Er
+ 9s9ku6N6QUHVm2HB8vKjx9rNeq62PZnQ+/rd5mX/nasuAAA=
+X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp;
+ fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29
+
+Description
+===========
+
+In the Linux kernel, the following vulnerability has been resolved:
+
+netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
+
+The commit mutex should not be released during the critical section
+between nft_gc_seq_begin() and nft_gc_seq_end(), otherwise, async GC
+worker could collect expired objects and get the released commit lock
+within the same GC sequence.
+
+nf_tables_module_autoload() temporarily releases the mutex to load
+module dependencies, then it goes back to replay the transaction again.
+Move it at the end of the abort phase after nft_gc_seq_end() is called.
+
+The Linux kernel CVE team has assigned CVE-2024-26925 to this issue.
+
+
+Affected and fixed versions
+===========================
+
+	Issue introduced in 5.4.262 with commit 4b6346dc1edf and fixed in 5.4.274 with commit 61ac7284346c
+	Issue introduced in 5.10.198 with commit 23292bdfda5f and fixed in 5.10.215 with commit 2cee2ff7f8cc
+	Issue introduced in 5.15.134 with commit b44a459c6561 and fixed in 5.15.155 with commit eb769ff4e281
+	Issue introduced in 6.1.56 with commit 5d319f7a8143 and fixed in 6.1.86 with commit 8d3a58af50e4
+	Issue introduced in 6.5 with commit 720344340fb9 and fixed in 6.6.26 with commit 8038ee3c3e5b
+	Issue introduced in 6.5 with commit 720344340fb9 and fixed in 6.8.5 with commit a34ba4bdeec0
+	Issue introduced in 6.5 with commit 720344340fb9 and fixed in 6.9-rc3 with commit 0d459e2ffb54
+	Issue introduced in 6.4.13 with commit e07e68823116
+
+Please see https://www.kernel.org for a full list of currently supported
+kernel versions by the kernel community.
+
+Unaffected versions might change over time as fixes are backported to
+older supported kernel versions.  The official CVE entry at
+	https://cve.org/CVERecord/?id=CVE-2024-26925
+will be updated if fixes are backported, please check that for the most
+up to date information about this issue.
+
+
+Affected files
+==============
+
+The file(s) affected by this issue are:
+	net/netfilter/nf_tables_api.c
+
+
+Mitigation
+==========
+
+The Linux kernel CVE team recommends that you update to the latest
+stable kernel version for this, and many other bugfixes.  Individual
+changes are never tested alone, but rather are part of a larger kernel
+release.  Cherry-picking individual commits is not recommended or
+supported by the Linux kernel community at all.  If however, updating to
+the latest release is impossible, the individual changes to resolve this
+issue can be found at these commits:
+	https://git.kernel.org/stable/c/61ac7284346c32f9a8c8ceac56102f7914060428
+	https://git.kernel.org/stable/c/2cee2ff7f8cce12a63a0a23ffe27f08d99541494
+	https://git.kernel.org/stable/c/eb769ff4e281f751adcaf4f4445cbf30817be139
+	https://git.kernel.org/stable/c/8d3a58af50e46167b6f1db47adadad03c0045dae
+	https://git.kernel.org/stable/c/8038ee3c3e5b59bcd78467686db5270c68544e30
+	https://git.kernel.org/stable/c/a34ba4bdeec0c3b629160497594908dc820110f1
+	https://git.kernel.org/stable/c/0d459e2ffb541841714839e8228b845458ed3b27
diff --git a/cve/published/2024/CVE-2024-26925.sha1 b/cve/published/2024/CVE-2024-26925.sha1
new file mode 100644
index 00000000..3e94c6d9
--- /dev/null
+++ b/cve/published/2024/CVE-2024-26925.sha1
@@ -0,0 +1 @@
+0d459e2ffb541841714839e8228b845458ed3b27