CVE Vulnerability Catalog

A bug in the Linux kernel's BPF x86 JIT was fixed regarding per-CPU address resolution into an extended register. The REX prefix was built using REX.B instead of REX.R, causing the high register bit to be lost and the per-CPU address to be written to the wrong register (e.g. R5 instead of R8). This led to dereferencing an invalid pointer and a kernel panic.

A vulnerability was fixed in the Linux kernel's __bpf_get_stack function. The per-CPU perf_callchain_entry buffer returned by get_perf_callchain() is not protected against reuse after being returned, so a preemptible BPF program can be scheduled out between obtaining the buffer and copying it, allowing another task on the same CPU to overwrite trace->nr with a larger value. This causes copy_len to be computed from the inflated value and leads to an out-of-bounds write in memcpy() and in the build_id path.

A vulnerability in the Linux kernel BPF bloom filter sizing and indexing on 32-bit kernels has been fixed. When the bitmap reaches the U32_MAX fallback case, an arithmetic error causes under-allocation, and negative bit offsets allow writes past the allocated object. This enables local privilege escalation on a 32-bit x86 kernel by a process with CAP_BPF.

The Linux kernel's dm-io module rebuilt destination bios for DM_IO_BIO requests by copying the source biovec, which with non-sector-aligned vector lengths (e.g. misaligned O_DIRECT buffers) could lose a sub-sector fragment and hang I/O. The fix clones the source biovec via bio_alloc_clone() and remaps it to the target device, eliminating manual page copying.

In the Linux kernel, the error codes BLK_STS_NOTSUPP and BLK_STS_INVAL should not cause leg failure on dm-raid1. The fix changes the dm-io interface to report two error bitmaps: error_bits and unsup_bits, where unsup_bits tracks unsupported errors, and dm-raid1 no longer fails a leg on such errors. This fixes misbehavior with unaligned bio vectors on dm-raid1.

The Linux kernel's dm-era module leaks a metadata block when a take-snap operation fails. metadata_take_snap() bumps the superblock refcount and allocates a new shadow block, but if the subsequent dm_sm_inc_block() fails, the block is never returned to the metadata space map. The fix frees the clone with dm_sm_dec_block() on error paths.

The Linux kernel's build_constructor_string() function in the dm-raid1 module does not reserve space for the NUL terminator after the maximum 20 decimal digits of a long long value. This can lead to a buffer overflow in sprintf(). The fix reserves additional space for the NUL terminator.

In the Linux kernel, the dm-array array_block_check() function only validated the block number and checksum, without checking the structural header fields. Crafted metadata with an entry count larger than the block capacity causes reads to walk off the dm-bufio buffer, triggered during dm-cache activation.

In the Linux kernel, the dm-array array_block_check() function only compares the header against itself, so a block with value_size 4 and max_entries 1018 passes validation. Pointing the dm-cache mappings root at a hint block causes element_at() to stride 8 bytes over 4-byte entries and reach beyond a 4096-byte block.

In the Linux kernel, the apple-soc cpufreq driver did not remove OPP tables on some failure paths and used the wrong helper dev_pm_opp_remove_all_dynamic() for cleaning up firmware-loaded OPP tables. The fix uses the cpumask OPP helper after the policy CPU mask is populated, paired with the matching remove helper on failure paths and in apple_soc_cpufreq_exit().

In the Linux kernel, fwctl_cmd_rpc() copies cmd->in_len bytes into a buffer, but the CXL callback cxlctl_fw_rpc() ignores in_len and never checks the user-controlled op_size against it. With a small in_len and large op_size the first memcpy() reads past the buffer and the data is sent to the device; a large enough op_size can oops the kernel.

In the Linux kernel, the CXL MCE notifier was registered per memory device and stored in struct cxl_memdev_state, even though it only needs region state. This caused lifetime issues leading to NULL dereferences and use-after-free in the MCE handler. The fix moves the notifier into struct cxl_region and registers it from cxl_region_probe() only for regions with an extended linear cache.

A use-after-free vulnerability exists in the Linux kernel's rfcomm_security_cfm() function in the Bluetooth RFCOMM subsystem. The function walks the session and DLC lists without holding rfcomm_mutex, allowing the krfcommd thread to concurrently free the same session and its DLCs. This results in a read of freed memory (KASAN: slab-use-after-free).

In the Linux kernel, kho_preserved_memory_reserve() calculates the preservation size as 1 << (order + PAGE_SHIFT), where '1' is a 32-bit integer, so it can only be shifted by 31 bits. Preservations larger than 2 GiB, obtainable via kho_preserve_pages() used by memblock reserve_mem, trigger undefined behaviour.

In the Linux kernel, the jbd2 shrinker only counted successfully released checkpoint buffers against nr_to_scan, so busy buffers did not consume the scan budget. With a large checkpoint list mostly of busy buffers, the shrinker could scan the entire list while holding journal->j_list_lock, causing long lock hold times and soft lockups or RCU stalls.

In the Linux kernel, journal_shrink_one_cp_list() skips busy checkpoint buffers when called with JBD2_SHRINK_BUSY_SKIP, and the continue statement also skips the need_resched() check at the end of the loop body. When a checkpoint list contains mostly busy buffers, the shrinker can walk the entire list while holding journal->j_list_lock even when a reschedule has been requested, causing soft lockups or RCU stalls.

In the Linux kernel, in collect_md mode ipip_tunnel_rcv() returns 0 without freeing the skb when ip_tun_rx_dst() fails to allocate the metadata_dst. Since ipip_rcv() and mplsip_rcv() are registered as xfrm_tunnel handlers, tunnel4_rcv() and tunnelmpls4_rcv() read the zero return as 'packet consumed' and do not free it either, leaking the skb.

A use-after-free vulnerability exists in the Linux kernel's IPv4/IPv6 multicast forwarding path. When a multicast packet is not locally deliverable, the skb retains an skb->sk association set by bpf_sk_assign() or UDP early demux even though a socket reference is not guaranteed. After the prefetched socket is destroyed, a later skb free invokes sock_pfree() and dereferences the stale skb->sk.

In the Linux kernel, ip6_tnl_xmit() uses skb_realloc_headroom(), which replaces the caller-owned skb and keeps the replacement only in a local variable. If an error occurs after reallocation (e.g., non-NONE encap rejection in collect_md tunnels or ip6_tnl_encap() failure), the caller still holds the original skb pointer, leading to a double free of the skb.

In the Linux kernel, ip6gre_tnl_link_config_route() incorrectly accumulates the lower device's hardware header length into dev->hard_header_len for NBMA ip6gre tunnels. This results in an incorrect hardware header length for the tunnel, potentially causing packet transmission issues.