CVE Vulnerability Catalog

A flaw was found in the Linux kernel SMB/CIFS client where server-side range operations (zero range, punch hole, insert range, collapse range) modified file contents without invalidating the FS-Cache cookie. As a result, subsequent reads could return stale data cached before the range operation.

A vulnerability in the Linux kernel's SCTP implementation causes a soft lockup due to inconsistent parameter iteration in ASCONF-ACK handling. A crafted ASCONF-ACK packet can trigger an infinite loop in softirq context, leading to a remote denial of service. Additionally, missing length validation for SCTP_PARAM_ERR_CAUSE allows an out-of-bounds read.

A use-after-free vulnerability exists in the Linux kernel's vxlan_mdb_remote_src_del() function related to VXLAN MDB entry handling. The vxlan_mdb_is_valid_source() function accepts an all-zeros source address, allowing aliasing of (*, G) and (S, G) entry keys, which leads to freeing and then reusing the same memory entry.

In the Linux kernel msc313e watchdog driver, msc313e_wdt_probe() does not set the platform device driver data, so dev_get_drvdata() in msc313e_wdt_suspend() and msc313e_wdt_resume() returns NULL, leading to a NULL pointer dereference. The fix sets the platform device driver data in msc313e_wdt_probe().

In the Linux kernel netfs subsystem, a subrequest reference leak occurs in netfs_unbuffered_write() when subreq->io_iter ends up zero length during preparation. The fix addresses this reference leak.

In the Linux kernel netfs subsystem, when netfs_alloc_subrequest() fails, subreq is NULL, and netfs_prepare_write() then tries to initialize its members, leading to a NULL pointer dereference. The fix properly handles the netfs_prepare_write() error.

A vulnerability was found in the Linux kernel's netfs subsystem related to readahead synchronization. The issue arises from the application thread adding folios to the rolling buffer while the collector thread processes them, potentially causing errors in determining folio order. The fix loads all folios selected by the VM upfront and drops references after I/O starts.

In the Linux kernel cachefiles subsystem, trace_cachefiles_coherency() is passed a pointer to a __be64 overlaid on variable-length coherency data (which may even be 0 bytes), potentially leading to a UAF or KASAN warning. The fix ensures the buffer has room for at least 8 pre-cleared bytes and extracts the data as four 2-byte words.

In the Linux kernel, a race condition exists in the ALSA subsystem between snd_pcm_mmap_data() and PCM buffer reallocation in snd_pcm_hw_params()/snd_pcm_hw_free(). Because mmap takes no lock, it can map pages of the old buffer that are subsequently freed back to the page allocator, leaving a stale, writable mapping of freed memory (a page-level use-after-free).

In the Linux kernel, ksmbd during logoff did not wait for all channels of an SMB3 multichannel session before freeing shared session objects. Added safe draining that wakes blocked byte-range locks, invokes cancellation callbacks for CANCEL requests, and serializes session teardown with channel registration.

In the Linux kernel, parse_dacl() in ksmbd silently accepted truncated ACEs and allocation failures, allowing set_info_sec() to continue with an incomplete ACL conversion. The fix propagates parsing and allocation errors to parse_sec_desc() so malformed security descriptors are rejected before inode attributes or ACL xattrs are updated.

In the Linux kernel, ksmbd allows a client to include many structurally valid but unmapped SIDs in a DACL, causing hundreds of kernel error messages per request. The fix rate-limits the logging of these mapping failures.

In the Linux kernel, the ksmbd listener thread exits when its listening socket is shut down. The netdevice notifier shuts down the socket before calling kthread_stop(), so the task_struct can be freed before kthread_stop() gets its reference. The fix creates the listener in a stopped state and holds an extra task_struct reference until kthread_stop_put() completes.

In the Linux kernel, the Bluetooth btintel driver's btintel_parse_version_tlv() does not ensure the TLV value is long enough for the specific type, potentially causing an out-of-bounds read via get_unaligned_le16(), get_unaligned_le32(), or memcpy(). The fix rejects values shorter than the minimum required by each known TLV type and also rejects responses without the Command Complete Status field.

In the Linux kernel, the Bluetooth btintel driver treats the firmware ID as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf() can read beyond the received response. The fix limits the conversion to the advertised TLV value length.

A vulnerability in the Linux kernel's Bluetooth subsystem (hci_core) involves a race condition during device registration. The power_on work item is queued before full initialization, and concurrent execution can lead to using an uninitialized mutex in msft_do_close(), triggering DEBUG_LOCKS warnings and potential instability.

In the Linux kernel, Bluetooth L2CAP's l2cap_le_connect_req() left the channel mode at the default, causing FLAG_DEFER_SETUP channels to reply to L2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect. This can lead to an out-of-bounds write in l2cap_ecred_rsp_defer(). The fix sets chan->mode correctly and adds a channel mode check with WARN_ON_ONCE instead of an OOB write.

In the Linux kernel, Bluetooth L2CAP's l2cap_chan_connect() checks the limit of pending ECRED channels, but only counts deferred channels. If 6 L2CAP sockets are connected at the same time in order DDDDND (D=deferred, N=non-deferred), the last can exceed the limit, causing an out-of-bounds write in the scid array and sending an invalid ECRED_CONN_REQ. The fix accounts for non-deferred pending channels in the counting and adds a WARN_ON_ONCE check.

A flaw in the Linux kernel's drm/pagemap subsystem allows the same device-private folio to be migrated twice. If a folio is being migrated from device memory to system memory, the raw-PFN eviction path can select the same folio and attempt migration again. This leaves an uncharged folio on an LRU list, causing folio_lruvec_lock_irqsave() to retry indefinitely, resulting in a soft lockup and RCU stall.

In the Linux kernel, the oa_tc6 driver's error recovery was improved for oversubscribed traffic. When the skb buffer lacks tailroom for incoming data, the frame is abandoned and the driver looks for a new frame. SK buffer allocation errors are now considered recoverable.