CVE Vulnerability Catalog

In the Linux kernel, in the lockdep module, the __lock_set_class() function does not check if register_lock_class() returned NULL. When the lock class pool is exhausted or validation fails, an invalid class index is computed, leading to a NULL or out-of-bounds pointer dereference.

In the Linux kernel for powerpc architecture in the XIVE subsystem, when xive_init_ipis() fails, the global xive_ipis array is freed. However, xive_smp_probe() previously ignored this failure and called xive_setup_cpu_ipi(), which dereferenced the already-freed pointer, leading to a use-after-free.

In the Linux kernel with CONFIG_PPC_KERNEL_PCREL enabled on PowerPC, call_do_irq() and call_do_softirq() use inline assembly without listing r2 as clobbered. This causes the compiler to assume r2 is preserved, leading to register corruption and kernel crashes during interrupt handling, preventing boot.

In the Linux kernel, in the OCFS2 filesystem, the function ocfs2_read_inode_block_full() used make_bad_inode(), which changes the inode type to S_IFREG. For a directory inode during active VFS lookup, this can lead to errors, including triggering VFS_BUG_ON_INODE().

In the Linux kernel, in the fs-integrity (block) subsystem, there is a missing check of BIP_CHECK flags before generating or verifying PI information. This can lead to incorrect invocation for non-PI metadata, generating incorrect metadata and crashes in the verification handler.

In the Linux kernel, the arm64 hibernation code manages exception masking incorrectly, leading to potential crashes or warnings during resume. When restoring a hibernated image, only interrupts are masked, not all DAIF exceptions, which may cause unexpected exceptions in an inconsistent state.

In the Linux kernel, a race condition exists in the btrfs subsystem between the thread finishing an extent buffer read and the thread unmounting the filesystem. The EXTENT_BUFFER_READING flag is not cleared within the same critical section as the reference count decrement, leading to false warnings in invalidate_and_check_btree_folios(). The fix introduces a helper free_extent_buffer_clear_reading() and synchronization on refs_lock.

In the Linux kernel for ARM64, an issue was found in the kernel exit path where local_irq_disable() was unnecessarily called in contexts where interrupts were already disabled or in NMI contexts. This confused the pNMI state tracking and caused warnings when CONFIG_ARM64_DEBUG_PRIORITY_MASKING is enabled. The fix splits arm64_exit_to_kernel_mode() into parts to avoid extra work and preserve correct logic.

A vulnerability in the Linux kernel's CPU isolation (housekeeping) mechanism was found, where memblock-allocated memory for the CPU mask was freed too early during boot, before the memory map was fully initialized. This caused a warning and potential system malfunction when using the 'nohz_full' boot parameter. The fix defers freeing this memory until initcall processing.

A vulnerability was found in the OCFS2 filesystem in the Linux kernel, involving a circular locking dependency between the ip_xattr_sem semaphore and the transaction barrier j_trans_barrier. This can lead to a deadlock during concurrent setxattr and mkdir/mknod operations. The fix precomputes the ACL state before starting the transaction and removes unnecessary semaphore acquisition.

In the Linux kernel, the acpi_get_first_physical_node() function may return a stale device pointer, potentially leading to a use-after-free. A new function acpi_bus_get_primary_device() has been introduced to mitigate this issue by properly managing references.

A use-after-free vulnerability has been found in the Linux kernel's vxlan_mdb_flush() function used for VXLAN multicast database (MDB) management. The flaw allows freeing one MDB entry while iterating over another, leading to a write to freed memory during deletion operations.

In the spi: amlogic-spisg driver, the clk_init_data structure is not fully initialized, which may cause a crash when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is enabled. The issue involves the uninitialized parent_names field.

In the drm/xe driver, there is an issue with a WARN warning during kernel job timeout when the device is already wedged. The fix honors the wedged state even for killed queues to avoid false warnings.

A race condition exists in the Linux kernel Bluetooth mgmt subsystem where the 'uuid_count' and 'uuids' fields of the discovery_state structure are accessed without proper locking. This can lead to a state where 'uuid_count' is non-zero but 'uuids' is NULL, causing a NULL pointer dereference and kernel panic. The fix adds discovery.lock around all reads/writes of these fields and ensures 'uuid_count' is set only after a successful kmemdup allocation.

In the octeontx2-af driver, there is an out-of-bounds read vulnerability when setting MSI-X IRQ affinity. The strstr() function may read beyond the buffer when the field is uninitialized, potentially triggering a KASAN error.

In the Linux kernel, a vulnerability in AppArmor was found where list heads are not properly initialized if profile creation fails before policy_init completes. This triggers warnings and a potential crash in aa_policy_destroy during profile free.

In the drm/sysfb: simpledrm driver, stride validation has been improved to check that the computed value does not exceed INT_MAX. This prevents potential overflow issues.

A flaw was found in the Linux kernel's secretmem mechanism (mm/secretmem) regarding accounting of locked pages. secretmem folios are not properly charged against RLIMIT_MEMLOCK or the process's RSS, so a user can repeatedly map and unmap (or fork) to bypass the limit and exhaust all available system memory with unevictable folios. This leads to system instability, and the OOM killer will not target the process because the memory usage is not accounted.

In the Linux kernel, the scsi: qla2xxx driver's __qla_consume_iocb() function consumed one too many response queue entries. This caused the wrong IOCB to be marked as processed and a legitimate firmware response to be silently dropped. The fix marks the head IOCB as processed and consumes only entry_count - 1 continuation IOCBs.