CVE Vulnerability Catalog

In the Linux kernel eventfs subsystem, an issue was found with using the list field as an RCU head and missing memory barriers. This could lead to reading corrupted data during iteration over the children list.

In the Linux kernel hwmon thermal driver, a commit was reverted that introduced a use-after-free in the error path of thermal_add_hwmon_sysfs(). The fix restores the removed validation.

In the Linux kernel ptp_ocp driver, an out-of-bounds read was found in the board ID field from EEPROM. The field is not NUL-terminated, which could lead to reading memory beyond the buffer.

In the Linux kernel ring-buffer subsystem, a missing initialization of the order field in the bpage structure was found. This could lead to incorrect freeing of buffers larger than a page.

A vulnerability was found in the Linux kernel's ring-buffer mechanism, where ring_buffer_swap_cpu() can swap per-CPU buffers during an ongoing write operation. The committing counter may temporarily drop to zero, allowing an unsafe buffer swap and leading to inconsistent state and RB_WARN_ON. The fix replaces the counter check with current_context checks, which are set at the start of the operation and remain valid throughout.

In the Linux kernel, the page_table_check mechanism incorrectly accounts special zero mappings (shared zero-page and huge zero PMD) as file-backed pages. An unprivileged process can create enough such mappings to overflow file_map_count and trigger BUG_ON().

In the Linux kernel, the ptdump mechanism has a race condition with kernel page table freeing. Previous fixes only protected ptdump for init_mm, but on x86 and arm64 ptdump can operate on other mm's, leaving the race. The fix acquires a nested mmap write lock for init_mm in ptdump_walk_pgd().

In the Linux kernel, the rt6_route_rcv() function has an incorrect validation of the Route Information option length (RFC 4191). Due to an off-by-one error, the kernel can read up to 8 bytes past the end of the option, potentially leaking data from adjacent memory into routes visible to userspace.

In the Linux kernel, the ip6ip6_err() function clones an outer IPv6 ICMP error skb and passes it to icmpv6_send() without clearing the outer packet's metadata in skb->cb. This can lead to out-of-bounds access on the quoted inner packet and corruption of skb_shared_info.

In the Linux kernel, the setattr_prepare() function contains an unnecessary check for fs-verity being enabled. This check is not needed and its presence can allow truncate operations on fsverity files to succeed, which is undesirable.

In the Linux kernel, the fscrypt_ioctl_set_policy() function uses nop_mnt_idmap instead of the mount's idmap when checking file ownership. On filesystems supporting idmapped mounts (e.g., ext4, f2fs), this can lead to incorrect denial of access to the actual owner or granting access to an unrelated caller.

A vulnerability in the Linux kernel's PSI (Pressure Stall Information) mechanism for cgroups was found. A race between psi_schedule_rtpoll_work() and psi_trigger_destroy() can lead to re-arming a timer after its deletion, resulting in a use-after-free when the timer fires on a freed group structure.

In the Linux kernel, the sched_ext mechanism has a potential deadlock due to lock ordering in scx_cgroup_lock(). The function locks scx_cgroup_ops_rwsem first and then cgroup_lock(), which can deadlock with cgroup rmdir operations and cpu.weight writes.

In the Linux kernel, the IMA mechanism lacks immediate reset of action cache flags (IMA_DONE_MASK) during truncate operations. The fix instantiates file_truncate and path_truncate hooks to force re-collection, re-measurement, re-audit, and re-appraisal on next access.

A vulnerability was found in the Linux kernel's __filemap_add_folio() function in mm/filemap. During retries of inserting a folio into the xarray, the index was not restored to its original value, potentially placing the folio at an incorrect (rounded-down) index. This caused rare SIGILL and SIGSEGV errors in production, as executable text was found in the wrong page.

In the Linux kernel, the bpf_get_fsverity_digest() function has an issue with dynptr assumptions. Although the BPF verifier and dynptr abstraction ensure memory validity, they do not guarantee stability of contents. The function could crash if arg->digest_size was concurrently modified. The fix uses the known-good value hash_alg->digest_size and widens types to u64.

A use-after-free vulnerability has been found in the Linux kernel's BPF sockmap mechanism during send verdict processing. The issue occurs because tcp_bpf_send_verdict() copies a pointer to the destination socket without taking a reference, which can lead to use of freed memory under concurrent access. An attacker could exploit this flaw to escalate privileges or cause a system crash.

In the Linux kernel, the SCTP protocol has a bug where a chunk's transport pointer is not updated when moved to another transport's list. This can lead to use-after-free when the transport is removed and the pointer becomes stale. The fix sets chunk->transport during the move.

In the Linux kernel, the SCTP protocol has a use-after-free vulnerability in the ASCONF mechanism. The cached ASCONF chunk is not properly cleared after release, leading to access to stale memory. The fix clears the addip_last_asconf pointer after release and protects against a race with T4 expiry.

A use-after-free vulnerability was found in the Linux kernel's SCTP subsystem. An authenticated remote SCTP peer can add and remove a transport within a single ASCONF chunk, leaving the new_transport pointer dangling. Subsequent operations (e.g., sending a HEARTBEAT) may read freed memory, as shown by a KASAN report in sctp_outq_select_transport.