CVE Vulnerability Catalog

In the Linux kernel, the ACPICA component adds validation of package length reading in acpi_ps_get_next_package_length(). The lack of validation could lead to improper processing of AML data.

In the Linux kernel, the ACPICA component prevents adding invalid references for local, argument, and debug objects in acpi_ut_copy_simple_object(). The flaw could lead to an invalid internal state of the ACPI interpreter.

An integer overflow exists in the Linux kernel's ACPICA function acpi_ex_opcode_3A_1T_1R() (mid_op). Missing overflow check for Index + Length can result in a negative size being passed to memcpy().

In the Linux kernel, ACPICA lacks validation of handler object type in acpi_ev_has_default_handler() and acpi_ev_find_region_handler(). This may allow improper operations on handler objects.

In the Linux kernel, ACPICA lacks package limit checks in parser functions. This may allow out-of-bounds access.

In the Linux kernel, ACPICA lacks validation for node in acpi_ns_build_normalized_path(). This may lead to use-after-free vulnerabilities.

In the Linux kernel, ACPICA enhanced OEM ID and Table ID validation in acpi_ex_load_table_op(). Lack of this validation could lead to buffer overflows.

In the Linux kernel, ACPICA's acpi_ns_custom_package() unconditionally dereferences the first element of the _BIX package without a NULL check. When firmware returns a _BIX package with an unresolvable reference, ACPICA evaluates it to NULL, causing a crash.

In the Linux kernel, a vulnerability in ACPICA was fixed by enhancing buffer validation in acpi_ut_walk_aml_resources(). Insufficient checks could lead to buffer overflows.

In the Linux kernel, a vulnerability in ACPICA was fixed by adding boundary checks in acpi_ps_get_next_namestring() and acpi_ps_peek_opcode(). Missing checks could lead to out-of-bounds access.

In the Linux kernel, a problem in perf/ftrace was fixed where perf_ftrace_function_unregister() called unregister_ftrace_function() without checking whether the ftrace_ops was successfully registered. This triggered a WARN_ON in __unregister_ftrace_function() when FTRACE_OPS_FL_ENABLED was not set.

In the Linux kernel, a vulnerability in the ath11k wifi driver was fixed where in certain cases hardware could provide packets with a length greater than the maximum native Wi-Fi header length. This could lead to invalid data access and memory corruption in ath11k_dp_rx_h_undecap_nwifi().

In the Linux kernel, a vulnerability in the ata: ahci driver was fixed where when an AHCI controller is disabled in BIOS, the HOST_CAP register may contain a bogus value (e.g., 0xFFFFFFFF). If CAP.NP claims more ports than can physically fit within the mapped BAR region, accessing port registers beyond the BAR boundary causes a kernel panic.

In the Linux kernel, a node refcount leak in net: qrtr was fixed. qrtr_send_resume_tx() calls qrtr_node_lookup() which takes a reference on the returned node. If the subsequent call to qrtr_alloc_ctrl_packet() fails due to memory allocation failure, the function returns -ENOMEM without releasing the node reference.

A vulnerability in the Linux kernel's NTFS3 filesystem can lead to a NULL pointer dereference during file writes after toggling system.ntfs_attrib and overwriting system.dos_attrib. The issue arises from overwriting full DOS attributes, causing inconsistency between compression flags and memory mapping operations. The fix preserves non-DOS attribute bits to maintain consistent compressed and sparse state.

A vulnerability was found in the Linux kernel's fs/ntfs3 module due to missing validation of index entry key bounds. A malformed NTFS directory index entry can advertise a key_size larger than the bytes actually present in its payload, causing an out-of-bounds read in cmp_fnames().

In the Linux kernel, a vulnerability in ntfs3 was fixed involving out-of-bounds read in ntfs_dir_emit() and hdr_find_e(). The bounds check in ntfs_dir_emit() did not account for UTF-16LE encoding (2 bytes per character) or the ATTR_FILE_NAME header size, allowing reads past the entry boundary.

In the Linux kernel, a problem in dpaa2-switch was fixed regarding FDB management on the bridge leave path. dpaa2_switch_port_set_fdb() always allocated a new FDB for a port becoming standalone, which in the case of multiple bridges on the same DPSW led to multiple ports sharing the same FDB.

In the Linux kernel, the DSA sja1105 driver's dsa_port_from_netdev() may return a port belonging to a different switch chip. Programming another chip's port index into the local hardware causes redirection to the wrong port or an out-of-bounds access if the index exceeds the local chip's port count.

In the Linux kernel, the dpaa2-switch driver shares NAPI instances for a DPSW device across all ports, but they are only disabled once the last port goes down. On the .remove() path, ports are unregistered one at a time, causing NAPI instances to be deleted even though they are not disabled.