CVE Vulnerability Catalog

In the Linux kernel, parse_tag_3_packet() fails to bound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64). When encrypted_key_size exceeds 64, decrypt_passphrase_encrypted_session_key() performs two out-of-bounds writes, corrupting the ecryptfs_auth_tok and ecryptfs_crypt_stat structures. Only AES-192 (cipher code 0x08) triggers this because it sets crypt_stat->key_size = 24 independently of encrypted_key_size.

In the Linux kernel, ecryptfs_parse_tag_70_packet() subtracted fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixed fields could underflow that size calculation.

In the Linux kernel, ecryptfs_send_message_locked() moved a message context from the free list to the allocated list before sending the request to the userspace daemon. If ecryptfs_send_miscdev() failed, the context was left on the allocated list and could not be reused.

In the Linux kernel, statfs() on the efivarfs mount point may be called by unprivileged users, which may result in a flood of calls to the QueryVariableInfo() runtime service. On x86 systems where the variable store is backed by SMM, each SMM entry requires a rendez-vous of all CPUs, making these calls disproportionately costly.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No further vulnerability information is available.

In the Linux kernel, in the erofs filesystem, z_erofs_gbuf_nrpages is advanced only after every global buffer has been grown. If a resize fails after some buffers were enlarged, a retry revisits those enlarged buffers, which can lead to allocation errors or pointer array overflow.

In the Linux kernel, ext2_setsize() and ext2_xattr_set2() contained a construct that for IS_SYNC inodes called sync_inode_metadata() instead of marking the inode dirty. Since sync_inode_metadata() only acts if the inode is already dirty, inode updates could be lost.

A use-after-free vulnerability exists in the Linux kernel's fanotify subsystem regarding file range information. A pointer to the range position stored on the triggering task's stack is saved in a heap-allocated permission event, and when a signal interrupts the triggering task, the stack frame is unwound while the event reader still dereferences that pointer. This causes a stale stack value to be copied to userspace.

In the Linux kernel's fbdev omapfb panel-dsi-cm driver, the ddata->lock mutex is initialized after the display is registered. Once omapdss_register_display() publishes the display, another consumer can invoke a dsicm callback that takes this uninitialized mutex. This can lead to improper operation or a crash.

In the Linux kernel, the fbdev ssd1307fb driver performed synchronous I2C transfers from damage callbacks, which may run from fbcon while printk has disabled preemption. This caused a "scheduling while atomic" bug and kernel warnings on systems such as RK3566. The issue was resolved by deferring I2C transfers from the damage callbacks.

In the Linux kernel's fbdev uvesafb driver, uvesafb_init() registers the v86d connector callback before registering the platform driver. If platform_driver_register() fails, the function returns the error without unregistering the connector callback, leaving it registered. The later platform-device failure path already performs this unregistration.

In the Linux kernel forcedeth driver, the loops in nv_suspend() and nv_resume() use 'i <= register_size/sizeof(u32)', causing one extra iteration and an out-of-bounds access to the saved_config_space array. On VER3 devices the last iteration reads past the array and, on resume, performs an MMIO write one dword past the mapped register window. The bug is reported by UBSAN and, with CONFIG_UBSAN_TRAP=y, traps and aborts the running kernel code.

A race condition in the Linux kernel fsnotify subsystem was fixed, affecting event mask updates for marks. Concurrent updates to different marks on the same object could leave the object mask stale, causing events such as FAN_MODIFY or IN_MODIFY to be missed despite correct configuration. The issue affected fanotify and inotify.

In the Linux kernel's hsi omap_ssi_core driver, the OMAP SSI driver uses a synthetic HSI controller device allocated via hsi_alloc_controller(), which does not go through the normal OF/platform device initialization path. As a result, the embedded struct device does not have a DMA mask initialized by default. After recent DMA API hardening changes, dma_map_sg() and related helpers require a valid dma_mask, otherwise the driver may crash or trigger warnings.

In the Linux kernel's hugetlb subsystem, __unmap_hugepage_range can adjust reservations since commit df7a6d1f6405. When a folio is mapped in both a parent and a child, and the parent unmaps the range first, the reservation adjustment causes an underflow of the reserved count. Once the child unmaps the range, the count is restored. The fix checks the mapcount before adjusting the reservation.

In the Linux kernel's accel/rocket driver, rocket_job_push() allocates a temporary array to hold input and output GEM object pointers. Two bugs exist: a missing NULL check after a failed kvmalloc_array() causing a NULL pointer dereference, and an integer overflow when summing in_bo_count and out_bo_count (both u32) that can wrap to a smaller value, leading to an undersized allocation and subsequent out-of-bounds accesses on the temporary array.

In the Linux kernel's accel/rocket driver, rocket_ioctl_submit_job() releases rjob via rocket_job_put() on allocation error paths. rocket_job_cleanup() unconditionally calls rocket_iommu_domain_put(job->domain), but job->domain is assigned only after task copying and BO lookups. A failure before that assignment can clean up a job with a NULL domain pointer. Additionally, rjob->tasks is not cleared after freeing in rocket_copy_tasks(), potentially leading to a double free.

In the Linux kernel, the rocket_job_run() function in the accel/rocket driver has error path bugs. The fence reference held by job->done_fence is never released, and pm_runtime_get_sync() increments the usage counter even on failure, preventing the NPU from suspending. Additionally, an unsignaled fence is returned to the DRM scheduler, triggering a WARN.

A deadlock exists in the Linux kernel's CXL CPER error handling within acpi/apei/ghes. The cxl_cper_work_lock and cxl_cper_prot_err_work_lock were used as plain spinlocks, which could deadlock when a GHES interrupt arrived on the same CPU. The fix converts them to raw_spinlock_t, adds WARN_ONCE checks, and restructures the unregister functions.

In the Linux kernel, the ghes_handle_arm_hw_error() function (ACPI APEI GHES) reduces the remaining length by sizeof(err) (pointer size) instead of sizeof(*err) (structure size) after skipping the cper_sec_proc_arm header. This overestimates the bytes left for cper_arm_err_info records and can cause the parser to read past the CPER section when err_info_num is large enough.