CVE Vulnerability Catalog

A vulnerability in the Linux kernel's BPF implementation for RISC-V architecture causes improper sign extension of struct ops return values, leading to a kernel panic during the ns_bpf_qdisc selftest due to invalid memory access.

In the Linux kernel, the tcp_metrics module replaced three dst_dev() calls with the lockdep-enabled helper dst_dev_net_rcu(). This is a security fix related to proper lock usage.

In the Linux kernel, in the DRM MSM driver, there is an object reference leak in the VM_BIND error path. If a handle lookup fails, previously obtained object references are not dropped.

In the NTFS3 subsystem of the Linux kernel, an integer overflow was found in the run_unpack function. A malformed runlist in an MFT record can lead to arbitrary disk data access or destruction, bypassing access controls.

In the Linux kernel, the NTFS3 driver lacks validation of the $BITMAP bitmap during index allocation. If the bitmap is empty while index blocks exist, on-disk corruption may occur.

A use-after-free vulnerability was discovered in the Linux kernel's SMC module in the __pnet_find_base_ndev() function. The issue occurs during connection setup when a network device is accessed after being freed, potentially causing system crashes.

In the Linux kernel crypto compression subsystem, there is a mismatch in the order of alloc_ctx and free_ctx operations in scomp_alg and crypto_acomp_streams structures. Structure layout randomization can cause the function pointer order to be inconsistent, leading to errors.

In the Linux kernel, the RDMA/rxe driver has a race condition in do_task() during draining, potentially leading to a use-after-free due to incorrect task state overwriting.

In the Linux kernel, the iommu/vt-d driver has an issue with dirty page tracking when the page walk is incoherent. Dirty page tracking relies on the IOMMU atomically updating the dirty bit in the paging-structure entry, which requires coherent memory between IOMMU and CPU. If the page walk is incoherent, the operation can result in a non-recoverable fault. The fix marks SSADS as supported only when both ecap_slads and ecap_smpwc are supported.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's F2FS filesystem in the f2fs_merge_page_bio() function. The issue is caused by a race condition where a bounce page used for encryption is freed before being accessed, leading to a NULL pointer dereference and kernel panic.

In the D-Link network driver in the Linux kernel, a missing memory allocation failure handling was found in the copy_thresh function. A failed skb allocation can lead to NULL pointer dereference and system crash.

W jądrze Linuxa rozwiązano podatność związaną z vhost i vringh, polegającą na niewłaściwej weryfikacji wartości zwracanej. Problem dotyczy funkcji copy_from_iter i copy_to_iter, które nie powinny zwracać wartości ujemnych, a sprawdzanie długości skopiowanych danych powinno być poprawne.

In the Linux kernel's uio_hv_generic driver, the default interrupt mask setting was removed because it should be fully controlled by userspace. Concurrent mask changes by the driver and user application could cause missed interrupts and system hangs.

In the Linux kernel, the io_waitid_wait() function (io_uring module) had an issue with removing the wait queue entry. On successful return, the entry should always be removed from the wait queue list. Previously this was skipped if a cancellation was in progress, which could race with another invocation of the wait queue entry callback.

In the Linux kernel, the io_uring/zcrx subsystem has a bug causing overshooting of the receive limit. Double counting of buffers in frag lists allows a request to receive more data than requested.

In the Linux kernel, the wcd937x audio codec driver (ASoC) had an issue where the SoundWire port for HPHL_COMP and HPHR_COMP was incorrectly set to zero. This can lead to memory corruption by accessing the -1th element of the port_map array.

In the Linux kernel, a vulnerability in the UDF filesystem allows an out-of-bounds read when handling Allocation Extent Descriptors. Malformed on-disk data can cause udf_update_tag() to call crc_itu_t() on out-of-bounds memory, triggering a KASAN use-after-free read.

In the NFC NCI subsystem of the Linux kernel, a missing packet data validation was found. The nci_valid_size() function did not validate data properly, potentially leading to processing of uninitialized memory and information leak.

In the Linux kernel for LoongArch architecture, a vulnerability was found in the BPF mechanism where return values from struct operations were not properly sign-extended. This caused pointers to be treated as 32-bit values, leading to a kernel panic during the ns_bpf_qdisc selftest.

A vulnerability in the Linux kernel's ksm_madvise function incorrectly clears the upper 32 bits of vma->vm_flags when handling the VM_MERGEABLE flag. This causes inconsistency in userfaultfd leading to a kernel panic (BUG) or warning.