CVE Vulnerability Catalog

In the Linux kernel, the ext4 filesystem may enable DAX on new encrypted files, causing data written to the file to bypass encryption. This occurs because the EXT4_INODE_ENCRYPT flag is set too late.

In the Linux kernel XFS filesystem, the attribute entry verification function accesses fields before checking whether the entry pointer is within buffer bounds. This can lead to an out-of-bounds read if the nameidx field points near the end of the buffer. Explicit bounds checks for entry pointers have been added before accessing their fields.

In the Linux kernel XFS filesystem, when __xfs_trans_commit() fails in xfs_trans_roll(), the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a circular lock dependency between xfs_nondir_ilock_class and fs_reclaim. The fix moves xfs_trans_set_context() before the error check so that nofs context is always restored on the new transaction.

In the Linux kernel NFC subsystem, the digital_in_recv_sensf_res() function copies data from an NFC-F device response into a fixed-size buffer without checking the upper bound of the length. A malicious nearby NFC-F device can send an oversized SENSF_RES response to overflow the stack buffer. The fix clamps the response length to the maximum allowed size before copying.

In the Linux kernel NFC subsystem for FDP (NXP) controllers, the fdp_nci_i2c_read() function takes the next packet length from two device-supplied bytes and never validates it. This can lead to a stack out-of-bounds write or an skb leak in case of a faulty device. The fix rejects lengths outside the allowed range and frees a previously allocated skb before allocating the next.

In the Linux kernel NFC subsystem for the Microread reader, the microread_target_discovered() function parses target discovery data but does not check whether the skb data length is sufficient for the fields being read. This can lead to out-of-bounds reads or copying data from beyond the buffer. The fix adds length validation for each data type before reading or copying.

A vulnerability was found in the Linux kernel's nfc_llcp_connect_sn() TLV parser in the NFC LLCP subsystem. The parser fails to check buffer boundaries when reading TLV headers and values, leading to out-of-bounds reads or infinite loops due to length underflow for short frames. The issue is remotely reachable by a nearby NFC device without authentication.

The TLV parsers in NFC LLCP (nfc_llcp_parse_gb_tlv and nfc_llcp_parse_connection_tlv) have three bugs: an u8 offset wraps after 255, missing bounds checks before reading the TLV header and data, leading to out-of-bounds reads. These functions are reachable without authentication via nfc_llcp_set_remote_gb.

The NFC LLCP receive path did not check that a frame is at least the LLCP header size before parsing. Short frames cause the size calculation to wrap, leading to out-of-bounds reads. This is reachable without authentication from a nearby NFC device.

In the pn533 NFC driver, the cleanup path did not purge fragment_skb, leading to memory leaks when the device is removed while fragments are still queued.

The NCI activation parameter extractors (nci_extract_activation_params_iso_dep and nci_extract_activation_params_nfc_dep) lack length checks before memcpy, allowing a crafted notification to cause a slab out-of-bounds read.

In the Linux kernel's NFC (NCI) subsystem, a vulnerability was found involving an out-of-bounds write in the nci_target_auto_activated() function. This function adds a target to a fixed-size array without checking if the array is full, which can lead to a write beyond the allocated memory region (slab out-of-bounds).

In the NCI RF discover and activated NTF handlers, on-stack structures are not initialized, and when the technology-specific parameter length is zero, uninitialized data is passed to nci_add_new_protocol, leading to an uninit-value read.

In ip_do_fragment(), undersized MTUs were not rejected, causing fragmentation to loop and eventually trigger a softlockup. The issue occurs when the effective MTU is smaller than hlen + 8.

In ip6_finish_output2(), a pointer to the IPv6 destination address is cached before invoking lwtunnel_xmit(), which can reallocate the skb head and free the memory. After LWTUNNEL_XMIT_CONTINUE, the stale pointer is used, leading to a use-after-free.

In nvmet_execute_auth_receive(), the response buffer is allocated with kmalloc() and not zeroed, and only part of it is filled by DH-HMAC-CHAP. Uninitialized data is sent to the initiator during the pre-authentication handshake.

In nvmet_fc_alloc_ls_iodlist(), the error unwind loop decrements iod past the start of the array, and the final kfree(iod) frees an invalid address, leading to an invalid free.

In the Linux kernel's NVMe-over-TCP subsystem (nvmet-tcp), a vulnerability allows unbounded kernel memory allocation. An attacker can send a crafted write command with an oversized SGL length (up to 4 GiB) that is not properly validated before buffer allocation, leading to uncontrolled memory consumption.

In the Linux kernel's nvmet-tcp subsystem, a vulnerability allows a remote initiator to control the size of SGL allocations, triggering a kernel warning (WARN_ON_ONCE_GFP) for very large allocations. The issue is fixed by adding GFP_NOWARN to the allocation flags to avoid kernel panic on systems with panic-on-warn enabled.

In the Linux kernel, a use-after-free vulnerability was found in the NVMe over Fabrics (nvmet) subsystem for PCIe Endpoint controllers (pci-epf). The function nvmet_pci_epf_exec_iod_work() reads iod->data_len and iod->dma_dir after calling req->execute(), but for commands without device-to-host data transfer, the iod can be freed asynchronously on another CPU before those fields are read, leading to a use-after-free.