CVE Vulnerability Catalog

W jądrze Linuxa rozwiązano podatność związaną z obsługą żądań skcipher o zerowej długości. Problem polegał na dostępie do losowej pamięci w przypadku takich żądań, co mogło prowadzić do nieprzewidywalnych zachowań systemu.

In the EROFS filesystem in the Linux kernel, a use-after-free bug was found when using multiple devices of different types. When the primary device is a block device and the extra is a file-backed device, erofs_init_device returns ENOTBLK, leading to access to freed memory.

In the Linux kernel on ARM64 with SME enabled, kernel FPSIMD state may be erroneously clobbered during context switch. When the CPU is in streaming SVE mode, restoring kernel FPSIMD state before exiting that mode (SMSTOP) causes register reset and data loss.

In the Linux kernel, in the arm-ni driver, failure to unregister PMUs (Performance Monitoring Units) after a failed probe can lead to list corruption and kernel panic. When resource allocation fails in one clock domain, previously registered PMUs in other domains are not properly rolled back.

A bug in the Linux kernel's BPF and sockmap mechanism causes a kernel panic when using kTLS. The issue occurs when a BPF program increases the data size in msg_pl->sg and then attempts to revert msg_iter, exceeding the iterator's actual size and triggering a BUG.

A bug in the Linux kernel's BPF sockmap mechanism causes a kernel panic when calling skb_linearize. The issue occurs when a large packet (over 100KB) is processed by the strparser module, and a previous addition of skb_get() to avoid race conditions triggered the BUG_ON(skb_shared(skb)) assertion.

In the Linux kernel, an inconsistency between SIT and SSA tables in the F2FS filesystem was found during block migration in an opened section. The issue occurs when fallocate on a pinned file causes SSA block data to be outdated because the last summary block is still in the curseg cache.

In the Linux kernel, a vulnerability was found in the netfilter module during lookup table allocation in the pipapo set. Missing overflow checks in multiplication can lead to integer overflow, potentially allowing privilege escalation or system crash.

In the Linux kernel, the RDMA/mlx5 driver has a bug in error handling during RQ destruction. When a firmware command fails, some software resources are already cleaned, leading to memory leaks and potential use-after-free. The fix rolls back the object to its original state upon failure.

In the Linux kernel, a vulnerability in BPF sockmap allows skb_send_sock() in the backlog thread to use a freed sk_socket pointer. A race condition between socket close and send operations causes a kernel panic.

In the Linux kernel af_packet subsystem, a bug causes a sleeping function (mutex) to be called from an RCU critical section. This occurs when PACKET_ADD_MEMBERSHIP is invoked on an ops-locked device, potentially triggering the NETDEV_UNREGISTER notifier that requires disabling promiscuous or allmulti mode, which in turn needs the netdev instance lock.

A vulnerability was found in the Linux kernel's dm_blk_report_zones function of the device mapper. The issue involves missing dm_put_live_table() call when dm_get_live_table() returns NULL, inconsistent reading of the md->zone_revalidate_map pointer, and a potential use-after-free during concurrent access to zone emulation resources. This flaw can lead to memory mismanagement and system crashes.

In the Linux kernel's IIO ADC ad4851 driver, a pointer handling bug was found for the ad4858 variant. The pointer returned by ad4851_parse_channels_common() was incremented internally, and then incremented again in ad4858_parse_channels(), causing indio_dev->channels to point past the end of the allocated array.

A use-after-free vulnerability was found in the Linux kernel's page_pool_recycle_in_ring function. The issue occurs when a page pool is freed while recycling the last page in the ring, leading to a read-after-free. A synchronization barrier was added to page_pool_release to prevent premature pool deallocation.

In the Linux kernel, the ice driver had a bug in Tx scheduler error handling during the XDP callback. Incomplete rollback after a queue configuration failure caused a system crash (general protection fault).

A vulnerability in the Linux kernel's UDP GSO segmentation handling for frag_list packets was discovered. Packet modifications by NAT or BPF can violate frag_list geometry assumptions, causing a kernel BUG in skb_segment. The fix linearizes packets that fail basic invariants.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's Bluetooth stack during the remove advertising monitor operation (MGMT_OP_REMOVE_ADV_MONITOR). The bug is caused by improper use of mgmt_pending_add, leading to access to already freed memory.

In the Linux kernel, a vulnerability was found in the Bluetooth stack where the mgmt_pending list lacked proper locking against concurrent access. This missing mutex protection caused a use-after-free condition, potentially leading to a system crash.

In the Linux kernel's ath12k WiFi driver, a use-after-free (UAF) vulnerability exists during initialization. If ath12k_core_hw_group_assign() or ath12k_core_hw_group_create() fails, the registered notifier chain is not properly unregistered, and its memory is freed after rmmod. Subsequent access to this chain can lead to UAF.

In the SFQ (Stochastic Fairness Queueing) qdisc in the Linux kernel, there is a crash vulnerability related to gso_skb handling. After adding packets to gso_skb, sch->q.len can be inflated, causing immediate packet drop even on an empty queue, leading to an invalid q->tail pointer state.