CVE Vulnerability Catalog

In the Linux kernel, the mt76 driver lacks a check whether the WCID (Wireless Client ID) has already been published before reinitializing the poll_list. This causes corruption of the dev->sta_poll_list structure, potentially leading to system crashes.

In the Linux kernel's mac802154 subsystem, a vulnerability was found due to missing skb_cow_data() calls before in-place cryptographic operations. LLSEC encrypt/decrypt functions modify shared skb data buffers, leading to data corruption, use-after-free, and kernel crashes under concurrent 802.15.4 traffic with security enabled.

Vulnerability in the Linux kernel ip_gre driver allows a user with CAP_NET_ADMIN in one network namespace to modify a GRE tunnel in another namespace where they lack privileges. Missing CAP_NET_ADMIN check in the target namespace.

Vulnerability in the Linux kernel AppArmor module allows bypassing connect mediation by using MSG_FASTOPEN flag in sendmsg(). A profile allowing send but blocking connect can be bypassed.

A use-after-free vulnerability was found in the rawdata deduplication loop of the AppArmor module in the Linux kernel. The issue occurs when an entry on the rawdata_list has a zero reference count and aa_get_profile_loaddata() performs an unsafe kref_get(), leading to a reference to freed memory.

In the Linux kernel, a vulnerability in keyctl_pkey_params_get_2() was found where incorrect output buffer length calculation can cause overflow when a too small buffer is provided. The fix allocates internal output with the size of the maximum cryptographic primitive length.

A use-after-free vulnerability was found in the Linux kernel's key management subsystem. A race condition between request_key() and KEYCTL_INSTANTIATE_IOV can cause use of freed request_key_auth payload memory.

In the Linux kernel F2FS filesystem, a vulnerability was found due to missing sanity checks in f2fs_get_node_folio_ra(). This can trigger a kernel BUG_ON during file truncation when a corrupted node has mismatched inode and nid in its footer.

In the Linux kernel's F2FS filesystem, the orphan inode recovery function trusts the entry_count from the checkpoint block. A corrupted value larger than F2FS_ORPHANS_PER_BLOCK causes an out-of-bounds read and interprets subsequent data as inode numbers, leading to a kernel panic.

In the Linux kernel's F2FS filesystem, is_meta_ino() unconditionally treats F2FS_COMPRESS_INO() as a meta inode even when compress_cache is disabled. This allows creating a fake internal inode with an out-of-range number, bypassing normal validation.

Vulnerability in the Linux kernel F2FS filesystem leads to a use-after-free (UAF) of f2fs_inode_info.atomic_inode during garbage collection. Missing reference counting can result in accessing freed memory.

In the Linux kernel's F2FS filesystem, a vulnerability was found due to missing validation of i_inline_xattr_size for inodes without the FI_INLINE_XATTR flag. An attacker can exploit a crafted filesystem image to set this value arbitrarily, leading to an out-of-bounds read when processing inline directories.

In the Linux kernel F2FS filesystem, a vulnerability was found due to missing validation of ACL entry sizes in f2fs_acl_from_disk(). A malformed ACL can cause an out-of-bounds read, confirmed by a KASAN report.

The Linux kernel reverts commit 9609dd704725 that removed non-uptodate folios from the page cache in move_data_block. The revert fixes kernel panics reported on nearly full f2fs partitions, caused by a race condition that corrupts the LRU list and frees pages with active LRU links.

In the Linux kernel's F2FS filesystem, a vulnerability was found in the __destroy_extent_node() function where setting the FI_NO_EXTENT flag does not reset the largest extent length to zero or update the inode folio, causing stale cached data and triggering a sanity check error.

In the Linux kernel, a bug was found in __cgroup_bpf_run_filter_sysctl() where a temporary buffer allocated by kvzalloc() was freed using kfree() instead of kvfree(). This can cause memory corruption on large allocations.

In the Linux kernel's KVM subsystem for x86, a vulnerability was found where the base GFN of a shadow page is not verified to be within the target memslot before querying the maximum mapping level. This can cause an out-of-bounds read in the lpage_info structure, resulting in a host page fault and potential system instability.

In the Linux kernel KVM component, a vulnerability allows a guest to trigger a kernel panic (BUG_ON) when writing to an ioeventfd with datamatch enabled. The issue occurs when a guest write crosses a page boundary and the second page contains a datamatch-enabled ioeventfd – an unaligned pointer dereference triggers the BUG_ON.

A bug in the Linux kernel's NX crypto driver (nx_crypto_ctx_exit) caused an incorrect argument type to be used. The nx_crypto_ctx_shash_exit function passed a context pointer (nx_crypto_ctx *) instead of a crypto_tfm * pointer, leading to a memory access violation and system crash (oops).

A use-after-free vulnerability was found in the Linux kernel's GFS2 filesystem in the gfs2_qd_dealloc function. During unmount, an RCU callback may access a freed superblock object, leading to potential security issues.