CVE Vulnerability Catalog

In the Linux kernel, a fix was made in the Tegra crypto driver to return ENOMEM when input buffer allocation fails for ccm. The fix ensures the ENOMEM error value is set when the allocation fails in tegra_ccm_do_one_req.

In the Linux kernel, a fix was made in the OCFS2 filesystem regarding buffer head management in ocfs2_read_blocks(). The fix clarifies that the caller should not assume that the buffer head returned by sb_getblk() is exclusively owned and that put_bh() always drops b_count from 1 to 0. To avoid a scenario where a buffer head remains on hold and may be returned with BH_Uptodate set despite previous validation failure, BH_Uptodate is now cleared immediately after the validate() callback detects data inconsistency.

In the Linux kernel, the IB/mlx5 driver has a vulnerability related to implicit ODP and rereg_mr operation. Due to child mkeys in the implicit ODP configuration, nothing can be changed in place for the parent mkey, so the whole structure must be rebuilt. Additionally, a race condition involving access to mr->pd by child keys was removed.

A circular locking dependency was found in the Linux kernel's OCFS2 filesystem during direct I/O write completion. The ocfs2_dio_end_io_write function could deadlock due to improper lock ordering involving system inodes (INODE_ALLOC, EXTENT_ALLOC, ORPHAN_DIR). The fix releases allocation contexts before acquiring the ORPHAN_DIR lock.

In the Linux kernel, the AFS filesystem has a memory leak related to an ungot volume. The afs_lookup_volume_rcu() function does not release a dying volume when afs_try_get_volume() fails.

In the Linux kernel, the AFS filesystem has a memory leak related to the vllist in afs_update_cell(). When the new list is empty (nr_servers == 0), the old list is not replaced, leading to a leak of the new list.

A vulnerability was found in the Linux kernel's ring buffer mechanism used by ftrace. When RB_FORCE_8BYTE_ALIGNMENT is enabled (e.g., on riscv64 with CONFIG_HAVE_64BIT_ALIGNED_ACCESS), ring_buffer_event_length() incorrectly calculates the length of small events, reporting a data length 4 bytes larger than expected. This causes inconsistent results in ftrace tests (trace_marker_raw).

In the Linux kernel, the IPVS module has a vulnerability in TCP state handling. The code reparses the packet to find the TCP header, using sizeof(struct ipv6hdr) for IPv6, while the actual transport header offset is already known from ip_vs_fill_iph_skb(). For IPv6 packets with extension headers, this leads to reading the wrong bytes.

In the Linux kernel, the DTS file for the Renesas Ironhide platform lacks descriptions of memory areas reserved for the DBSC5 DRAM controller with inline ECC. If these areas are not properly reserved, Linux may use and corrupt the memory used by the controller, leading to system instability.

In the Linux kernel, KVM for arm64 has a vulnerability where ESR_EL2 is not written when injecting nested SError exceptions. The kvm_inject_el2_exception() function writes ESR_EL2 for synchronous exceptions but not for SError, causing the L2 guest to observe a stale ESR_EL2.

In the Linux kernel, the ALSA HDA driver for TAS2781 has a vulnerability where the asynchronous firmware request is not cancelled during unbind. This can lead to a situation where the firmware callback operates on state that is being torn down, potentially causing errors or races.

In the Linux kernel, the Xilinx TRNG cryptographic driver removed the crypto_rng interface because it was not used. The removal eliminates bugs such as returning success without filling all bytes and the possibility of concurrent execution of xtrng_trng_generate() and xtrng_hwrng_trng_read(), which could interfere with each other.

In the Linux kernel's amdkfd driver, the CRIU restore flow did not properly validate user-supplied IDs before passing them to idr_alloc. IDs larger than INT_MAX can trigger a WARN in the IDR layer, potentially causing a panic or reboot if panic_on_warn is enabled.

In the Linux kernel's NTFS filesystem, the ntfs_read_inode_mount() function improperly validates attribute-list entries during mount. A short entry with attacker-controlled length can cause an out-of-bounds read when the attribute list size is a multiple of the sector size.

In the Linux kernel's NTFS3 filesystem, the allocation of inline_data used kmemdup, which did not guarantee page alignment. This caused a BUG in iomap_write_end_inline when the inline data validity check failed. The fix allocates with alloc_page to ensure page alignment.

In the Linux kernel for the Alpha architecture, pci_mmap_resource() did not check security_locked_down(LOCKDOWN_PCI_ACCESS) before allowing userspace to mmap PCI BARs. The generic version has this check to prevent DMA attacks when the kernel is locked down.

In the Linux kernel's TIPC subsystem, tipc_exit_net() contains a busy-wait loop waiting for UDP bearer cleanup works to complete. Under certain conditions (e.g., high-priority task or non-preemptive kernel), the loop can run for a long time, wasting CPU cycles and leading to soft lockups. The fix replaces the loop with wait_var_event().

In the Linux kernel's BPF subsystem, copy_user_syms used __get_user without a prior access_ok call on the user space pointer. This missing check could lead to improper memory access. The fix adds the missing access_ok call for the whole pointer array and simplifies the error path.

A Cross-Site Scripting (XSS) vulnerability in Netgate pfSense Plus software versions <= 26.03 and pfSense CE software versions <= 2.8.1 exists in the captive_portal_status.widget.php file. A remote attacker can exploit this to execute arbitrary code in the victim's browser.

A vulnerability in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO devices allows a remote attacker to execute arbitrary code via the Android Debug Bridge (ADB) daemon (adbd).