CVE Vulnerability Catalog

In the Linux kernel, the query_capability() function (ACPI pfr_update) copies four ACPI buffer objects returned by firmware _DSM into fixed-size u8[16] fields in struct pfru_update_cap_info using memcpy with the firmware-supplied length. If the firmware returns buffer.length > 16, memcpy writes past the destination array, causing a stack buffer overflow.

The Linux kernel has a bug in ata_format_dsm_trim_descr(), which builds the ATA TRIM descriptor in a 2048-byte buffer. On devices with a logical sector size larger than 2048 bytes (e.g. 4Kn with 4096-byte sectors), the function can never return the expected sector size, so every TRIM is rejected with a parameter list length error and triggers WARN_ON() splats.

In the Linux kernel, in the auxdisplay charlcd driver, with CONFIG_CHARLCD_BL_FLASH enabled, charlcd_init() schedules bl_work before charlcd_register() calls misc_register(). If registration fails, the caller frees the charlcd object while delayed work still contains its address, leading to a use-after-free.

The Linux kernel did not validate user space vector alignment when building a bio from iov_iter. Bio-based block drivers did not necessarily check the alignment split, potentially causing incorrect behavior. The fix validates vectors against the device's dma_alignment and rejects misaligned ones with -EINVAL.

The Linux kernel's eir_get_service_data() function in the Bluetooth EIR module contains an out-of-bounds read. Incorrect recalculation of eir_len when skipping fields causes the pointer to walk past the le_per_adv_data[] buffer into the rest of struct hci_conn. The fix recomputes eir_len from the end of the buffer each iteration.

The Linux kernel's bnx2x driver contains a double free in the error path of bnx2x_init_firmware(). The pointers init_ops, init_data, and init_ops_offsets are not set to NULL after being freed, so a later call to bnx2x_release_firmware() frees them again. The fix sets each pointer to NULL after kfree().

A bug in the Linux kernel's BPF x86 JIT was fixed regarding per-CPU address resolution into an extended register. The REX prefix was built using REX.B instead of REX.R, causing the high register bit to be lost and the per-CPU address to be written to the wrong register (e.g. R5 instead of R8). This led to dereferencing an invalid pointer and a kernel panic.

A vulnerability was fixed in the Linux kernel's __bpf_get_stack function. The per-CPU perf_callchain_entry buffer returned by get_perf_callchain() is not protected against reuse after being returned, so a preemptible BPF program can be scheduled out between obtaining the buffer and copying it, allowing another task on the same CPU to overwrite trace->nr with a larger value. This causes copy_len to be computed from the inflated value and leads to an out-of-bounds write in memcpy() and in the build_id path.

A vulnerability in the Linux kernel BPF bloom filter sizing and indexing on 32-bit kernels has been fixed. When the bitmap reaches the U32_MAX fallback case, an arithmetic error causes under-allocation, and negative bit offsets allow writes past the allocated object. This enables local privilege escalation on a 32-bit x86 kernel by a process with CAP_BPF.

The Linux kernel's dm-io module rebuilt destination bios for DM_IO_BIO requests by copying the source biovec, which with non-sector-aligned vector lengths (e.g. misaligned O_DIRECT buffers) could lose a sub-sector fragment and hang I/O. The fix clones the source biovec via bio_alloc_clone() and remaps it to the target device, eliminating manual page copying.

In the Linux kernel, the error codes BLK_STS_NOTSUPP and BLK_STS_INVAL should not cause leg failure on dm-raid1. The fix changes the dm-io interface to report two error bitmaps: error_bits and unsup_bits, where unsup_bits tracks unsupported errors, and dm-raid1 no longer fails a leg on such errors. This fixes misbehavior with unaligned bio vectors on dm-raid1.

The Linux kernel's dm-era module leaks a metadata block when a take-snap operation fails. metadata_take_snap() bumps the superblock refcount and allocates a new shadow block, but if the subsequent dm_sm_inc_block() fails, the block is never returned to the metadata space map. The fix frees the clone with dm_sm_dec_block() on error paths.

The Linux kernel's build_constructor_string() function in the dm-raid1 module does not reserve space for the NUL terminator after the maximum 20 decimal digits of a long long value. This can lead to a buffer overflow in sprintf(). The fix reserves additional space for the NUL terminator.

In the Linux kernel, the dm-array array_block_check() function only validated the block number and checksum, without checking the structural header fields. Crafted metadata with an entry count larger than the block capacity causes reads to walk off the dm-bufio buffer, triggered during dm-cache activation.

In the Linux kernel, the dm-array array_block_check() function only compares the header against itself, so a block with value_size 4 and max_entries 1018 passes validation. Pointing the dm-cache mappings root at a hint block causes element_at() to stride 8 bytes over 4-byte entries and reach beyond a 4096-byte block.

In the Linux kernel, the apple-soc cpufreq driver did not remove OPP tables on some failure paths and used the wrong helper dev_pm_opp_remove_all_dynamic() for cleaning up firmware-loaded OPP tables. The fix uses the cpumask OPP helper after the policy CPU mask is populated, paired with the matching remove helper on failure paths and in apple_soc_cpufreq_exit().

In the Linux kernel, fwctl_cmd_rpc() copies cmd->in_len bytes into a buffer, but the CXL callback cxlctl_fw_rpc() ignores in_len and never checks the user-controlled op_size against it. With a small in_len and large op_size the first memcpy() reads past the buffer and the data is sent to the device; a large enough op_size can oops the kernel.

In the Linux kernel, the CXL MCE notifier was registered per memory device and stored in struct cxl_memdev_state, even though it only needs region state. This caused lifetime issues leading to NULL dereferences and use-after-free in the MCE handler. The fix moves the notifier into struct cxl_region and registers it from cxl_region_probe() only for regions with an extended linear cache.

A use-after-free vulnerability exists in the Linux kernel's rfcomm_security_cfm() function in the Bluetooth RFCOMM subsystem. The function walks the session and DLC lists without holding rfcomm_mutex, allowing the krfcommd thread to concurrently free the same session and its DLCs. This results in a read of freed memory (KASAN: slab-use-after-free).

In the Linux kernel, kho_preserved_memory_reserve() calculates the preservation size as 1 << (order + PAGE_SHIFT), where '1' is a 32-bit integer, so it can only be shifted by 31 bits. Preservations larger than 2 GiB, obtainable via kho_preserve_pages() used by memblock reserve_mem, trigger undefined behaviour.