CVE Vulnerability Catalog

A vulnerability in the Linux kernel's XFS filesystem causes under-reservation of blocks when repairing shortform directories. Incorrectly setting args->total to 1 instead of the actual directory block count (fsbcount) triggers an assertion failure and can lead to a filesystem shutdown.

In the Linux kernel, the _maxlevels_ondisk functions for rtrmap and rtrefcount in XFS fail to account for the inode root when computing the size of in-memory btree cursors. With a sufficiently large btree, this can lead to accessing beyond the end of the cursor.

In the Linux kernel, XFS's xmi_can_exchange_reflink_flags() can move the reflink flag between files during range exchange, but when XFS_EXCHMAPS_INO1_WRITTEN is set, some mappings may be skipped. This can clear the reflink flag from an inode that still owns shared written extents, leading to data corruption.

In the Linux kernel, XFS's xrep_dir_recover_data can spin forever if it encounters an unused dirent that claims to have length zero. The fix also prevents the same issue with zero-length entries.

In the Linux kernel, XFS's xfs_btree_bload_prep_block may fail to release new_bp if xfs_btree_bload_drop_buf hits an I/O error while writing the delwri buffer list to disk. This results in a leaked locked buffer.

In the Linux kernel, XFS's xqcheck_mod_live_ino_dqtrx does not free the newly allocated dqa object if rhashtable insertion fails. This leads to a memory leak.

In the Linux kernel, XFS's xchk_dirtree_create_path fails to destroy the seen inode bitmap if the directory path object is created but appending the name to the path fails. A similar bug exists in xrep_dirtree_create_adoption_path.

In the Linux kernel, XFS's xrep_agfl_fill does not check the result of xagb_bitmap_walk, silently dropping errors from xagb_bitmap_set and proceeding with inconsistent incore data.

In the Linux kernel, the ath9k_htc wifi driver stores a usb_device_id pointer that is not guaranteed to live longer than probe due to dynamic ID. The fix stores only driver_data, as other information can be retrieved from usb_device.

In the Linux kernel, the pegasus USB network driver relies on id table pointer arithmetic, which is broken with dynamic ID because the usb_device_id in probe lives on the heap and the computed index can be wildly out of bounds. The fix uses the driver_info field instead of a side table.

In the Linux kernel, the USB xusbatm driver relied on pointer arithmetic over the device ID table, which with dynamic IDs caused an out-of-bounds index (pointer on the heap). The fix removes that arithmetic and sets no_dynamic_id, since the driver does not support dynamic IDs anyway.

In the Linux kernel, the hwmon asus_rog_ryujin driver did not validate HID report lengths before parsing response headers and payload fields. A short report could make the driver read uninitialized bytes from the HID buffer and expose them as sensor values via sysfs.

In the Linux kernel, the scsi qla2xxx driver had two bugs on the queue creation error path: calling dma_free_coherent() with a NULL pointer and inconsistent bitmap locking (vport_lock vs mq_lock), which could cause a race and clobber a queue entry. The fix adds a NULL check and uses mq_lock in the free functions.

In the Linux kernel, the scsi qla2xxx driver could trigger a use-after-free during queue teardown: free_irq() did not cancel work already queued on ha->wq, so qla_do_work() could access a freed qpair and response queue. The fix adds cancel_work_sync() after free_irq() and before freeing memory.

In the Linux kernel, the scsi qla2xxx driver did not bound the virtual port index (vp_index) to the size of the vp_idx_map bitmap (16 bytes) in the IOCB. A vp_index above 128 could cause an out-of-bounds write, corrupting adjacent IOCB fields or the request-ring slot.

In the Linux kernel, the f2fs filesystem incorrectly updated the free_sections counter during free_segment_range() when some sections in the truncated range were already free. This overestimated available free sections and caused inconsistent accounting, potentially leading to allocation failures or assertion errors when space is tight.

A use-after-free vulnerability was found in the Linux kernel's x86/mm/pat subsystem. A race condition exists between attribute changes and CPA collapse, potentially leading to a write to freed memory. The issue is resolved by acquiring an mmap read lock on init_mm during attribute change operations.

In the Linux kernel, the scsi qla2xxx driver freed pointers on the qla2x00_mem_alloc() error path without clearing them, leading to double frees in qla2x00_mem_free(). Additionally, for dma_pool members it called dma_pool_free() after s_dma_pool had been destroyed and set to NULL, dereferencing a NULL pool.

In the Linux kernel, the scsi qla2xxx driver could re-register a virtual port that was being deleted (VPORT_DELETE) during report ID acquisition, even though its d_id had already been zeroed. This left an entry in host_map and later caused a use-after-free after scsi_host_put().

In the Linux kernel, a vulnerability in the qla2xxx SCSI driver causes a CPU soft lockup. The functions qla27xx_copy_multiple_pkt() and qla27xx_copy_fpin_pkt() poll the signature field in the response structure, but in continuation IOCBs this field contains FC frame payload that may accidentally equal 0xDEADDEAD, leading to an infinite loop.