CVE Vulnerability Catalog

In the Linux kernel's autofs module, there is a memory leak in the autofs_fill_super() function. If creating root_inode fails, the function returns -ENOMEM without freeing the previously created inode, leading to a memory leak. The fix adds a call to autofs_free_ino() in the error path.

In the Linux kernel, the EROFS filesystem has a vulnerability in LZMA decoder pool resizing. On partial allocation failure, a broken stream remains in an inconsistent state, potentially passing NULL to xz_dec_microlzma_reset().

In the Linux kernel, the fbdev vfb driver has a use-after-free vulnerability because the colormap is freed immediately after unregistering the framebuffer, even when an open file still holds a reference. This can lead to a read-after-free during copy to userspace.

In the Linux kernel, the idpf driver has a vulnerability where DIM works are not disabled before freeing q_vectors memory. These works can run on freed memory, leading to a use-after-free condition.

A vulnerability in the Linux kernel's IPv6 packet fragmentation mechanism (inet: frags) was found. Improper flushing of fragment queues before their removal can lead to use of stale metadata, resulting in out-of-bounds access and heap corruption. An attacker with access to unprivileged network namespaces can exploit this for local privilege escalation.

In the Linux kernel, the ieee802154 6lowpan subsystem has a NULL pointer dereference vulnerability in lowpan_newlink. A TUN device can change its link type to ARPHRD_IEEE802154 without initializing ieee802154_ptr, leading to a crash.

In the Linux kernel, the ieee802154 cc2520 driver has a use-after-free vulnerability in FIFOP work. After driver removal, the FIFOP interrupt can still queue work after flush, allowing execution after private data is freed.

In the Linux kernel, the ieee802154 hwsim driver has a double-free vulnerability in hwsim_update_pib. PIB updates are not serialized, leading to a race and double-free of the object.

In the Linux kernel, the IPv4 FIB subsystem has a vulnerability of unbounded table ID probing during automatic allocation. This can lead to long RTNL hold times, causing performance issues.

In the Linux kernel, the IPv6 flowlabel subsystem has a vulnerability of unbounded lease list growth per socket. Repeated GET requests can lead to uncontrolled memory consumption.

In the Linux kernel, the IPVS subsystem has a vulnerability of accepting invalid states in connection template sync records. This can lead to using an invalid state as an index in TCP/SCTP transition tables.

In the Linux kernel's mac802154 subsystem, a use-after-free vulnerability was found in the RX frame queueing mechanism. The softirq producer adds beacon and MAC-command frames to lists without locking, and the worker processes them after the interface may have been freed, leading to dereferences of freed memory (sdata). The issue was confirmed by KASAN.

A use-after-free vulnerability was found in the Linux kernel's Landlock module, in the current_check_refer_path() function. During linkat() processing, the module accesses the source directory's parent without holding a reference or lock, allowing concurrent rename(2) and rmdir(2) to free and reuse memory. The issue is fixed by properly taking a reference on the parent dentry.

In the Linux kernel, the iommu/s390 subsystem has a NULL pointer dereference in iova_to_phys() when using a 5-level translation table via ZPCI_TABLE_TYPE_RFX. get_rso_from_iova() returns NULL when the region-first entry is invalid, but get_rto_from_iova() does not check this before accessing rso[rsx].

In the Linux kernel, the s390/crypto subsystem fails to scrub temporary buffers in the AES CTR and GCM algorithms. The buffer processing remaining bytes < AES_BLOCK_SIZE in ctr_aes_crypt() was not scrubbed, and gcm_aes_crypt() error paths did not scrub the CPACF parameter block or the gcm_sg_walk struct buffers.

In the Linux kernel, the s390/crypto subsystem lacks proper handling of the EBUSY return code in the PHMAC algorithm when a request is transferred to the crypto engine. crypto_transfer_hash_request_to_engine() returns EINPROGRESS or EBUSY to signal success, but EBUSY was not handled.

In the Linux kernel, the s390/crypto subsystem fails to scrub temporary buffers in the PAES algorithm. The buffer processing remaining bytes < AES_BLOCK_SIZE in ctr_paes_do_crypt() was not scrubbed, and __xts_2keys_prep_param() only scrubbed the key field instead of the whole parameter block.

In the Linux kernel, the s390/crypto subsystem returns an incorrect code in asynchronous crypto engine callbacks. When crypto_finalize_hash_request() or crypto_finalize_skcipher_request() explicitly completes a request, the do_one_request callback must return 0; returning a negative error code causes a double completion.

In the Linux kernel, the s390/crypto subsystem propagates persistent -EBUSY after exhausting key conversion retries to crypto_finalize_*_request(). The crypto API completion wrapper treats -EBUSY as a queueing status and swallows it, preventing the completion callback from firing.

In the Linux kernel, the RISC-V perf subsystem stored the available-counter mask as a single unsigned long, but iteration uses RISCV_MAX_COUNTERS which is 64. On RV32 this reads past the object, and setting an unsigned-long bit at index 32 and above is also wrong.