CVE Vulnerability Catalog

W jądrze systemu Linux zidentyfikowano podatność związana z wyciekiem pamięci w funkcji ice_set_ringparam. Problem polega na tym, że w przypadku niepowodzenia alokacji rx_rings, tx_rings i xdp_rings pozostają niezwolnione, co prowadzi do wycieku pamięci.

In the Linux kernel netfilter/nf_tables subsystem, a vulnerability was found due to unnecessary set cloning during flush operations. A memory allocation failure with GFP_KERNEL triggers a WARN splat and may cause system instability.

A NULL pointer dereference vulnerability was found in the Linux kernel's bridge br_do_suppress_nd() function. It occurs when IPv6 is disabled via ipv6.disable=1 and an ICMPv6 Neighbor Discovery packet reaches the bridge, causing a kernel crash.

In the Linux kernel, the ETS (Enhanced Transmission Selection) network scheduler has a divide-by-zero vulnerability in the offload path. The issue is caused by unsigned integer overflow when computing WRR weights, potentially leading to a kernel panic.

W jądrze Linuxa zidentyfikowano podatność związaną z niewłaściwym dziedziczeniem parametrów przez zadania SCHED_DEADLINE podczas zmiany priorytetu. Problem ten może prowadzić do błędów w obliczaniu pasma, gdy zadanie nie jest poprawnie oznaczane jako wzmocnione.

In the Linux kernel, the dell-wmi-sysman driver's set_new_password() function hex dumped the entire buffer containing plaintext passwords. The hex dump has been removed to prevent credential leakage.

An AB-BA deadlock was discovered in the Linux kernel during PHY LED trigger registration. The issue occurs when both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY are enabled, causing mutual blocking when accessing the trigger list and the RTNL mutex.

In the Linux kernel, the kalmia USB driver lacks validation of USB endpoints. A malicious USB device without the expected endpoints can cause a kernel crash when the driver blindly accesses them.

A vulnerability has been identified in the Linux kernel in the ioremap_prot() function, which may lead to memory read errors from the kernel level on arm64 systems with PAN enabled. The issue lies in returning a new user mapping that is inaccessible to the kernel.

In the Linux kernel irdma driver, a kernel stack leak was found in irdma_create_user_ah(). The reserved field of the response structure is not zeroed before being sent to userspace, leaking 4 bytes of stack memory.

A vulnerability was found in the Linux kernel's MPTCP (Multipath TCP) endpoint management. It triggers a warning when removing an endpoint with both 'signal' and 'subflow' flags while the MPTCP subflow limit is set to 0. The issue stems from incorrectly marking the endpoint as used, leading to state inconsistency.

A vulnerability in the Linux kernel allows changing the transmission hash policy to vlan+srcmac while an XDP program is loaded on a bond in 802.3ad or balance-xor mode. This can lead to incompatibility and errors when destroying bonds.

A NULL pointer dereference vulnerability was found in the Linux kernel's ip6_rt_get_dev_rcu() function. It occurs when a slave device is being un-slaved from a VRF, causing l3mdev_master_dev_rcu() to return NULL and leading to a system crash.

A data race vulnerability was found in the Linux kernel around the sk->sk_data_ready and sk->sk_write_space pointers. The skmsg layer (and possibly others) modifies these pointers while other CPUs may read them concurrently, leading to undefined behavior.

A vulnerability in the Linux kernel causes a system panic when an IPv4 route references an IPv6 nexthop object configured on a loopback interface. The issue stems from misclassifying such an object as a reject route, skipping initialization of the nhc_pcpu_rth_output structure, leading to a NULL pointer dereference.

W jądrze Linuxa zidentyfikowano podatność związaną z błędami w kolejce socketów Bluetooth. Gdy włączone jest znacznik czasu TX, pakiety mogą utknąć w kolejce błędów, co prowadzi do ich wycieku, jeśli nie zostaną odczytane przez użytkownika lub kontroler zostanie niespodziewanie usunięty.

W jądrze Linuxa zidentyfikowano i naprawiono podatność związaną z wyciekiem pamięci struktury cred w funkcji nfsd_nl_threads_set_doit(). Problem polegał na tym, że referencja do cred była przekazywana, ale nie była odpowiednio zwalniana, co prowadziło do wycieku pamięci.

W jądrze Linuxa zidentyfikowano podatność, która prowadzi do zakleszczenia podczas wstrzymywania i wznawiania aplikacji. Problem występuje, gdy aplikacja wydaje zapytanie IOCTL w trakcie automatycznego wstrzymywania, co prowadzi do blokady zasobów.

A vulnerability in the Linux kernel's VXLAN driver causes a NULL pointer dereference in the IPv6 neighbor table (nd_tbl) when booting with the 'ipv6.disable=1' parameter. An attacker can send a crafted IPv6 packet to a VXLAN interface, triggering route_shortcircuit() and leading to a kernel Oops and potential system crash.

The pegasus USB driver in the Linux kernel lacks validation of USB endpoints. A malicious USB device can crash the driver by not providing the expected endpoints.