CVE Vulnerability Catalog

In the Linux kernel, a race condition was fixed in the OA TC6 network driver between reference pointers for TX packets. The issue involves managing two skb pointers for packets enqueued from the network stack.

A low-privilege authenticated Samba AD user can modify internal LDB special DNs via LDAP access, enabling a domain takeover.

An out-of-bounds read was found in the NC-SI OEM response handler of libslirp. A truncated NC-SI OEM Ethernet frame causes ncsi_rsp_handler_oem() to read up to 4 bytes beyond the supplied packet length and reflect the value into the response sent to the guest, resulting in guest-observable disclosure.

In the Linux kernel, the drm/amdgpu driver changed the handling of the vm->task_info object. The object is now dynamically allocated and reference-counted, improving safety and stability.

In the Linux kernel's networking subsystem, a dangling sk pointer is left when socket creation fails, potentially leading to use-after-free when __sock_release() is called with an fentry probe.

In the Linux kernel's bcachefs filesystem, a missing bounds check in superblock validation could allow out-of-bounds read. The fix adds the missing check.

In the Linux kernel's fork function, a race condition exists between fork and hugetlbfs file operations. The fix defers linking the file VMA until the VMA is fully initialized.

In the Linux kernel's F2FS filesystem, there is potential corruption when moving a directory, similar to an issue in ext4. The fix addresses this problem.

In the Linux kernel, in the Bluetooth subsystem (hci_conn), the function disable_delayed_work_sync is used instead of cancel_delayed_work_sync, which not only cancels ongoing work but also disables new submissions, which is desirable.

In the Linux kernel, in the DRM/XE driver (guc_submit), a race condition around the suspend_pending field was fixed, which could cause assertions and warnings in certain test scenarios.

In the Linux kernel, in the Bluetooth subsystem (MGMT), possible deadlocks were fixed that could occur due to hci_cmd_sync_dequeue, causing threads to block for extended periods.

In the Linux kernel, in the L2TP subsystem, a possible tunnel refcount underflow was fixed, which could occur during session deletion when the tunnel pointer was invalid.

In the Linux kernel, a vulnerability was found in the tracing mechanism where trace_event_file lacks reference counters. This can lead to use-after-free and kernel crash.

In the Linux kernel, in the Btrfs filesystem, an issue with readahead on the relocation inode was fixed when the filesystem uses a RAID stripe tree (RST), which could cause ENOENT errors.

In the Linux kernel, a proper folio cleanup was fixed in Btrfs when cow_file_range() fails. The issue involved improper handling of dirty pages.

In the Linux kernel, the Bluetooth subsystem (hci_core) now disables works during hci_unregister_dev because the hci_dev is about to be freed and new submissions should not be allowed.

In the Linux kernel, in the RDMA/hns driver, a soft lockup issue under heavy CEQE load was fixed by moving CEQE handling to the BH (bottom half) context.

In the Linux kernel, the Android Binder driver no longer stores a pointer to a VMA for later use outside the mmap_lock. This was unsafe because the pointer could reference freed memory.

In the Linux kernel, in the NFS server (nfsd), a race between the laundromat thread and the free_stateid operation was fixed, which could lead to incorrect handling of expired delegations.

In the Linux kernel, an overflow in the ring-buffer's __rb_map_vma function was fixed, which occurred when calculating the number of pages (nr_pages). A check was added before the calculation to avoid the issue.