CVE Vulnerability Catalog

In the Linux kernel, bpf_arena_free_pages() accepted arena addresses below the arena base, which after masking to the low 32 bits and reconstructing the user address led to freeing a range outside the arena mapping. The fix rejects such frees before computing the clipped range.

In the Linux kernel, the BPF interpreter does not support arena-related instructions, yet interpreter fallback was allowed for them, leading to a BUG_ON() hit in ___bpf_prog_run() at runtime. The fix sets jit_required to true when an arena map is used in the program to disallow interpreter fallback.

In the Linux kernel, the BPF interpreter does not recognize the BPF_JMP|BPF_JA|BPF_X instruction used for the insn_array map, leading to a BUG_ON() hit in ___bpf_prog_run() at runtime. The fix sets jit_required to true when an insn_array map is used in the program to disallow interpreter fallback for the gotox instruction.

In the Linux kernel, the dmaengine dw-edma driver called vchan_cookie_complete() on a deferred STOP, scheduling a callback for the active descriptor and leaving other descriptors queued. A late callback after dmaengine_terminate_sync() could dereference freed client state, and leftover descriptors could restart into reused buffers. The fix moves all issued and submitted descriptors to the terminated list without scheduling callbacks.

In the Linux kernel, the dw-edma dmaengine driver's dw_edma_abort_interrupt() drops vc.lock before updating request and channel status. In that window issue_pending() can observe the old busy state and skip starting queued descriptors, after which the abort handler overwrites the channel status as idle, permanently stranding the new descriptors.

In the Linux kernel, the dw-edma dmaengine driver's pause() and resume() read and update channel state without holding vc.lock, while interrupt handlers update the same state under it. This can record a pause request on an already idle channel that no further interrupt will acknowledge, permanently wedging the channel.

In the Linux kernel, the ASoC meson driver's meson_card_reallocate_links() grows the DAI link and private data arrays with two consecutive krealloc() calls, updating owner pointers only after both succeed. If the first krealloc() moves the data and the second fails, card->dai_link points to an already freed block, leading to a use-after-free and double free.

In the Linux kernel, the iio dac ad5686 driver is missing a NULL check on the chip_info pointer. If a user binds the driver via sysfs driver_override with a device name not present in the id_table or of_match_table, the match data will be NULL.

In the Linux kernel, the RDMA hfi1 driver's set_txreq_header_ahg() ignores the return value of sdma_txinit_ahg(). When initialization fails, tx->txreq is not initialized, yet the caller continues processing the request as though it had succeeded.

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, intended solely for data portability, to deploy and execute malicious code on the underlying application server host.

In the Linux kernel, the RDMA rxe driver's rxe_requester() does not validate num_sge/cur_sge for WQEs from a user queue. A local unprivileged user can post a WQE with an out-of-range cur_sge or oversized num_sge, forcing an out-of-bounds read of the per-WQE sge array in copy_data() (vmalloc OOB read).

In the Linux kernel, the irqchip gic-v3-its driver's its_vpe_irq_domain_alloc() fails to invoke its_vpe_teardown() in the error path when its_irq_gic_domain_alloc() fails. This leaks the resource associated with the corresponding interrupt.

In the Linux kernel, the RDMA nldev module's RDMA_NLDEV_ATTR_STAT_HWCOUNTERS is a nested attribute whose children are consumed directly with nla_get_u32(). The top-level policy validates only the container, not the fixed shape of each child.

In the Linux kernel, the ACPI processor module's IOAPIC hotplug lookup parses both MADT and _MAT records without full bounds validation. The MADT walk used a subtable's declared length to advance the cursor after only locating a generic header, and the _MAT path likewise passed a generic header to the IOAPIC helper.

In the Linux kernel, the ACPI PCI module's acpi_pci_root_add() assigns the freshly allocated root to device->driver_data before dmar_device_add() and pci_acpi_scan_root(). Only the pci_acpi_scan_root() path clears driver_data before freeing root, so when dmar_device_add() fails a dangling pointer remains. acpi_pci_root_remove() has the same problem.

In the Linux kernel, the BPF queue and stack pop/peek helpers did not zero the output buffer on a failed lock acquisition. BPF programs could observe uninitialized stack contents. The fix clears the buffer before returning -EBUSY.

In the Linux kernel on RISC-V, a memory leak occurs in the BPF JIT. When JIT compilation fails for a later subprogram, bpf_jit_free() does not free the context offset array, causing a leak. The fix adds the missing kfree.

In the Linux kernel on RISC-V with CONFIG_CFI_CLANG enabled, tailcalls in BPF cause kernel stack corruption. Due to double counting the kcfi instruction, the jump skips an extra 4 bytes and misses stack pointer adjustment. The fix removes this double inclusion.

In the Linux kernel on RISC-V, exception handling for BPF load_acquire operations is missing an extable entry, causing a kernel oops on a faulty memory access. Additionally, the rd register is not cleared on fault, allowing data leakage through a map. The fix checks ret >= 0 before adding the handler and passes rd for LOAD_ACQ to zero it on fault.

In the Linux kernel's BPF, the offset check for the BPF_RES_SPIN_LOCK instruction incorrectly uses the offset for BPF_SPIN_LOCK instead of res_spin_lock_off. The fix corrects this to use the proper field.