CVE Vulnerability Catalog

A vulnerability was found in the Linux kernel's filesystem freezing mechanism. After a change in freeze counting, a nested thaw operation returned an incorrect -EINVAL error despite successfully releasing one freeze. This leads to a permanent block device lock, preventing remounting.

In the Linux kernel, the gennetlink policy dump keeps pointers to the target family's operation and policy tables in its callback state. The target family's module is not pinned, so it can be unregistered and unloaded while a policy dump is pending. Advancing the dump then dereferences policy memory from the unloaded module.

In the Linux kernel, drm_exec_prepare_array() silently returns success without calling drm_exec_lock_contended() when num_objects is zero. This breaks the invariant that every entry point must first attempt to lock any previously contended object. Drivers chaining multiple calls can spin forever when an empty array never clears exec->contended.

In the Linux kernel, the query_perf_config_list() function in the drm/i915 driver has a memory leak. When krealloc() fails, the original oa_config_ids array is not freed before returning, leading to a memory leak.

Rojo's "rojo serve" HTTP API (default port 34872) lacks Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open() with no user interaction beyond visiting the page.

In the Linux kernel, the rockchip_dp_drm_encoder_enable() function in the drm/rockchip analogix_dp driver uses sprintf() to format a device tree path into a 32-byte stack buffer. Device tree paths are not limited to this size, so a sufficiently long path can overflow the buffer.

In the Linux kernel, the drm/xe driver's emit_render_cache_flush() did not request a flush of the LSC untyped L1 dataport cache before releasing memory for reuse. Starting with MTL, the coupling between HDC Pipeline Flush and the untyped L1 cache flush no longer holds reliably, potentially allowing stale data to leak. The fix explicitly sets PIPE_CONTROL0_UNTYPED_DATAPORT_CACHE_FLUSH on Xe2 and later platforms.

A vulnerability was found in the Linux kernel's io_uring/rw subsystem. Moving write accounting completion to task_work causes a deadlock during filesystem freeze, as the task waits on the sb_writers semaphore. The fix moves write accounting completion back to the ki_complete handler, leaving only fsnotify calls in task_work.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

In the Linux kernel, the ring_buffer_subbuf_order_set() function stores the new order and only then checks CPUs, returning -EBUSY if any has resizing disabled. A user-mapped buffer has resizing disabled, and __rb_map_vma() reads buffer->subbuf_order without the mutex, so an mmap racing the failing order change can size the mapping incorrectly.

In the Linux kernel, in net/sched act_api when a batched RTM_NEWACTION request replaces an existing action, tcf_idr_check_alloc() takes a temporary reference. If a later action fails to initialize, tcf_action_destroy() uses strict release semantics, which for a filter-bound action returns -EPERM without dropping the reference. This leaks the action and its IDR slot.

In the Linux kernel's network bridge module, there is an issue with CFM and MRP frame handling. When these protocols are enabled on multiple bridges, the same list node is added to multiple lists, leading to list state corruption when unregistering on one bridge. The fix tracks per-bridge enable state using option bits and dispatches the handler directly, also reducing the net_bridge structure size.

In the Linux kernel's DSA tagger for Broadcom (tag_brcm), there is an issue with FCS calculation for nonlinear frames. The tagger does not declare the required tailroom, causing an out-of-bounds read (slab-out-of-bounds) during CRC calculation. The fix declares the required tailroom, which disables SG and FRAGLIST features and linearizes frames before processing.

In the Linux kernel's MANA driver (Microsoft Azure Network Adapter), there is an issue with the RX queue size. The queue is sized to hold exactly one CQE per WQE, but hardware may post an additional fence CQE, which in rare cases leads to no slot available and dropping that CQE, while the driver waits holding the RTNL lock. The fix reserves an extra slot for the fence CQE.

A vulnerability in the Linux kernel's MPLS handling was found where the inner_protocol field is not cleared after popping the last MPLS label. This can lead to a negative network header offset, causing Open vSwitch to perform a massive memcpy out of bounds, resulting in a system crash (page fault).

In the Linux kernel's Open vSwitch module, there is a use-after-free vulnerability related to the flow table mask array. The function tbl_mask_array_realloc() retires the old array before it is fully out of use, allowing a read after free in a certain time window. The fix publishes the new array before retiring the old one.

In the Linux kernel's netfs module, there is an issue with an uninitialized return value in the netfs_unbuffered_write() function. If preparation of the first subrequest fails, the loop exits before ret is initialized, which can lead to returning an incorrect error code. The fix initializes ret to 0.

A use-after-free vulnerability was found in the Linux kernel's netfilter cttimeout module during module unload. nf_ct_set_timeout() protects the timeout hook and policy lookup with rcu_read_lock(), but cttimeout_exit() unregisters per-net operations before clearing the hook, allowing access to freed memory. KASAN reported slab-use-after-free in ctnl_timeout_find_get.

A race condition in the Linux kernel's netfilter nf_log module allows a use-after-free when loggers are unregistered. The incorrect ordering lets a sysctl or netlink writer rebind a logger after per-net state is cleared but before the global backend is removed, leading to a dangling pointer.

In the Linux kernel's ifcvf driver (Intel FPGA Virtual Function), there is a resource leak issue on unsupported feature error. When a feature is not supported, the driver does not properly release the allocated device and adapter pointer. The fix routes the error through the common path to ensure resource release.