CVE Vulnerability Catalog

A bug was fixed in the Linux kernel's xprtrdma module (RDMA transport for NFS/SunRPC). When rpcrdma_post_recvs() failed to create a work request (e.g., due to memory allocation failure) or exited early, the ep->re_receiving counter was not decremented, causing a hang in rpcrdma_xprt_drain() as the counter never reached zero.

In the Linux kernel, the net/mlx5e driver has a DMA FIFO desync bug during TX queue recovery after an error CQE. mlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc, causing unmapping of stale DMA addresses and triggering a warning in iommu_dma_unmap_page.

In the Linux kernel, a vulnerability related to error handling in the emac_tx_mem_map() function has been fixed. In case of a mapping error, DMA mappings were leaked, which has been resolved by freeing them using the existing emac_free_tx_buf() function.

A vulnerability related to DMA mapping error handling in the SPI driver for Amlogic has been fixed in the Linux kernel. Issues included unnecessary gotos, double unmap, and incorrect unmap sizes.

In the Linux kernel, a vulnerability related to double-free in the remove() function of the rockchip-sfc driver has been fixed. The issue was caused by a manual call to spi_unregister_controller(), which could lead to a double-free.

In the Linux kernel ASoC subsystem, a use-after-free occurs in snd_soc_dapm_stream_event() called from the close_delayed_work handler. When a sound card is unbound while a PCM stream is open, newly scheduled delayed work is not caught by the earlier flush, and soc_remove_link_components() frees DAPM widgets before the work fires.

In the Linux kernel, a vulnerability was found in the bonding mechanism where bond_setup_by_slave() directly copies the header_ops pointer from a slave device (e.g., GRE tunnel) to the bond device. This causes a type confusion because header functions like ipgre_header() use netdev_priv() to access device-specific private data, and when called on the bond device, they retrieve the bonding structure instead of the expected IP tunnel structure, leading to reading garbage values and kernel crashes.

A vulnerability in the Linux kernel related to duplicate device registration in netdev hooks has been fixed. The issue occurred during the handling of NETDEV_REGISTER notifications, which could lead to incorrect device registrations.

In the Linux kernel, a stack out-of-bounds read in netfilter nft_set_pipapo's pipapo_drop() was fixed. The rulemap[i + 1].n argument was read past the rulemap array on the last iteration.

In the Linux kernel netfilter (x_tables) there is an out-of-bounds read of the option area. When the last byte of options is a non-single-byte option kind, the option walkers (xt_tcpudp, xt_dccp) can read op[i+1] past the end of the option area. An explicit i == optlen - 1 check was added before dereferencing op[i+1].

In the Linux kernel, an out-of-bounds read in netfilter nfnetlink_cthelper's nfnl_cthelper_dump_table() was fixed. A 'goto restart' placed outside the for loop bypassed the bounds check, causing an 8-byte read past nf_ct_helper_hash.

In the Linux kernel, the nvme_dbbuf_set function in the nvme-pci driver has an incorrect loop condition that allows an out-of-bounds read (slab-out-of-bounds). The queue index exceeds the valid range, causing a 2-byte read beyond the allocated buffer. The vulnerability is fixed by correcting the loop condition to keep indices within 1..online_queues-1 (excluding the admin queue at index 0).

A vulnerability has been identified in the Linux kernel related to use-after-free in the iavf module during reset. This issue arises from improper thread management, which may attempt to access freed resources, leading to system crashes.

A vulnerability has been identified in the Linux kernel related to the io_uring mechanism, concerning the bounds check for 128-byte SQE_MIXED operations. The flaw involved validating the logical position instead of the physical SQE index, potentially leading to unauthorized memory access.

A NULL pointer dereference vulnerability exists in the Linux kernel bonding driver when IPv6 is disabled via ipv6.disable=1. Receiving an IPv6 NS/NA packet on a slave interface with ARP/NS validation enabled can reach ipv6_chk_addr() and crash the kernel in __ipv6_chk_addr_and_flags().

A vulnerability in the Linux kernel has been resolved in the mana_gd_setup() function. In the event of a setup error, the gc->service_wq pointer was set to NULL after destroying the workqueue, preventing a use-after-free error.

In the Linux kernel, a vulnerability related to the improper invocation of the css_put() function in scx_cgroup_init() has been resolved. This issue could lead to a reference count underflow, creating a risk of a Use-After-Free vulnerability.

In the Linux kernel, ALSA PCM has a use-after-free vulnerability on linked stream runtime in snd_pcm_drain(). The 'runtime' variable is reassigned to a linked stream's runtime, and after releasing the lock, accesses to runtime fields may refer to freed memory if the stream is concurrently closed. The fix caches needed fields into local variables before releasing the lock.

A vulnerability has been identified in the Linux kernel related to Rust Binder, allowing improper page insertion into the wrong virtual memory area (vma). The issue arises when a vma is closed and replaced with another vma at the same address, potentially enabling write access to pages that should be read-only.

A vulnerability has been identified in the Linux kernel's rust_binder mechanism that allows reading values from the offsets array. If the target process gains the ability to write to its own vma, it can change the offset before it is read back, leading to misinterpretation by the kernel.