CVE Vulnerability Catalog

A vulnerability has been identified in the Linux kernel related to double reference release in the SPI controller removal function. The issue occurs in meson_spicc_remove(), where calling spi_controller_put() again leads to a double-put error.

In the Linux kernel, the amdgpu driver has a memory leak and use-after-free vulnerability during DSC validation in atomic mode. The issue occurs when a DSC configuration change is processed together with an unrelated mode change, causing incorrect reset of the mode_changed flag.

A vulnerability has been identified in the Linux kernel related to regulator operations in the hwmon (pmbus/core) module, which were not protected by a mutex, potentially leading to race conditions. The pmbus_regulator_notify() function has been modified to use a worker function to send notifications outside of mutex protection.

In the Linux kernel's SPI driver for Freescale LPSPI (spi-fsl-lpspi), a teardown order issue causes a use-after-free (UAF). The SPI controller was registered using devm_spi_register_controller(), delaying its unregistration, while fsl_lpspi_remove() immediately tore down DMA channels, leading to a NULL pointer dereference during active SPI transfers.

W jądrze Linuksa naprawiono podatność, która pozwalała na odczyt poza granicami (OOB) w funkcji sprawdzającej zawijanie SQE_MIXED. Problem dotyczył iteracji po oczekujących SQE, gdzie niewłaściwe sprawdzenie mogło prowadzić do odczytu danych spoza tablicy sq_sqes.

In the Linux kernel, the drm/xe driver has a bug in tracking remap prev/next ranges during rebind operations. When the unwind path is triggered, virtual address ranges can overlap and leave the VM in a bad state, causing a kernel warning and potential system instability.

W jądrze systemu Linux zidentyfikowano podatność, która pozwala zdalnemu atakującemu na unieważnienie aktywnej sesji poprzez wysłanie żądania związania z błędnym hasłem. W wyniku tego, sesja jest niepoprawnie oznaczana jako wygasła, co prowadzi do ataku typu DoS.

W jądrze systemu Linux zidentyfikowano podatność związaną z podwójnym zwolnieniem pamięci przy użyciu devm_kzalloc() w module sma1307. Poprzednia zmiana wprowadziła sprawdzanie NULL oraz czyszczenie dla niepowodzeń alokacji, jednak czyszczenie dla wpisów mode_set było błędne.

In the Linux kernel's CAN ISO-TP subsystem, a use-after-free vulnerability was found in isotp_sendmsg(). Improper synchronization of so->tx.buf access allows the buffer to be freed during socket close while another thread is still using it.

In the Linux kernel, the media (mc, v4l2) subsystems allow MEDIA_REQUEST_IOC_REINIT to run concurrently with the VIDIOC_REQBUFS(0) queue teardown path, racing request object cleanup against vb2 queue cancellation and causing use-after-free reports. The fix extends req_queue_mutex serialization to REQBUFS and takes the same mutex in media_request_ioctl_reinit().

A vulnerability has been identified in the Linux kernel related to the iptfs_clone_state() function. The issue is that x->mode_data is stored before the allocation of the reorder window, which may lead to pointing to freed memory in case of allocation failure.

In the Linux kernel, the virt tdx-guest module did not validate the host-controlled quote_buf->out_len value that determines how many bytes of the quote are copied to guest userspace. The host could specify a response length larger than the guest's allocation or race modifying it during consumption, allowing reads beyond the pages allocated for quote_buf (up to TSM_REPORT_OUTBLOB_MAX).

A use-after-free (UAF) vulnerability in the dst_ops structure was found in the Linux kernel's virtio_net driver. It occurs when IFF_XMIT_DST_RELEASE is cleared and napi_tx is disabled, leading to freed memory access during transmit buffer cleanup.

A vulnerability related to double free in the dma-buf feature in the vfio/pci module has been identified in the Linux kernel. The error path mishandles reference counting, which may lead to file descriptor exhaustion.

In the Linux kernel scsi ibmvfc driver, ibmvfc_discover_targets_done() accepts a num_written value from the VIO server that exceeds max_targets and stores it without validation in vhost->num_targets. This value is then used as the loop bound indexing disc_buf[], causing out-of-bounds access beyond the DMA-coherent allocation and leaking kernel memory.

W jądrze systemu Linux zidentyfikowano podatność, która została naprawiona. Problem dotyczy sekwencji odmontowywania w funkcji xfs_unmount_flush_inodes(), gdzie AIL był przesuwany podczas działania odzyskiwania w tle i inodegc, co mogło prowadzić do nieprawidłowego działania.

In the Linux kernel XFS subsystem, xfs_inode_item_push() and xfs_qm_dquot_logitem_push() dropped the AIL lock before performing buffer IO. Once the cluster buffer no longer protected the log item from reclaim, the log item could be freed by background reclaim or the dquot shrinker, and the subsequent spin_lock() dereferenced lip->li_ailp, causing a use-after-free.

In the Linux kernel XFS filesystem, log items may be dereferenced after push callbacks. If the AIL lock is dropped during xfsaild_push_item(), background inode reclaim or the dquot shrinker can free the log item, and tracepoints in the switch statement dereference it after iop_push() returns, leading to use-after-free.

A vulnerability in the Linux kernel's ext4 filesystem occurs when truncate() grows a file beyond inline data capacity without converting to extent-based storage. This leaves the inline flag set while the file size exceeds inline capacity, causing a BUG_ON() on subsequent write attempts.

In the Linux kernel ext4 filesystem, a vulnerability was found where the jinode pointer is published before full initialization. This can lead to dereferencing an uninitialized i_vfs_inode field, causing a kernel panic during fast commit operations.