CVE Vulnerability Catalog

In the Linux kernel, the 9p (trans_fd) module has a double-lock issue in p9_conn_cancel. After moving requests to a local list, the lock is no longer needed but is released too late, causing a deadlock.

In the Linux kernel ethtool_cmis_module_poll() function, using the wrong size for the rpl structure causes stack corruption and kernel panic.

W jądrze Linuksa rozwiązano podatność związaną z protokołem MCTP, która dotyczyła ustawienia SOCK_RCU_FREE. Problem polegał na tym, że wyszukiwanie gniazda mogło być przerwane w trakcie operacji, co mogło prowadzić do nieprzewidzianych zachowań.

W jądrze Linuxa naprawiono podatność związaną z walidacją długości klucza zagnieżdżonego w akcji set() w openvswitch. Problem polegał na niebezpiecznym dostępie do długości atrybutu, gdy dane były mniejsze niż nagłówek netlink.

In the Linux kernel, a vulnerability was found where the refcount of non-slab folios in iov_iter is not incremented, leading to a use-after-free (UAF) bug. This occurs during EROFS file-backed mounts over v9fs, potentially causing system crashes.

In the Linux kernel, the ksmbd SMB server has a use-after-free vulnerability in __smb2_lease_break_noti(). When a connection is disconnected, tcp_transport is freed but the connection object may still be in use, leading to UAF.

In the ksmbd SMB server in the Linux kernel, a use-after-free vulnerability exists in smb_break_all_levII_oplock() due to unlocking in the middle of a loop.

In the Linux kernel's Nouveau driver, a dangling pointer dereference in ttm_bo_delayed_delete causes a general protection fault. The issue arises when drm_prime_gem_destroy destroys a dma_buf before TTM operations complete, leading to memory corruption.

In the Imagination GPU driver (powervr), a reference is not taken for geometry jobs paired with fragment jobs. This leads to a Use-After-Free.

NVIDIA TensorRT-LLM dla każdej platformy zawiera podatność w executorze Pythona, która pozwala atakującemu na spowodowanie problemu z walidacją danych poprzez lokalny dostęp do serwera TRTLLM. Udane wykorzystanie tej podatności może prowadzić do wykonania kodu, ujawnienia informacji oraz manipulacji danymi.

Sterownik wyświetlacza GPU NVIDIA dla systemu Linux zawiera podatność, która może pozwolić nieuprzywilejowanemu atakującemu na eskalację uprawnień. Udane wykorzystanie tej podatności może prowadzić do wykonania kodu, odmowy usługi, eskalacji uprawnień, ujawnienia informacji oraz manipulacji danymi.

In the Linux kernel, the TIPC protocol has a memory leak in tipc_link_xmit(). When the backlog transmit queue for high-priority messages is full, the function returns -ENOBUFS without purging the skb list, causing a memory leak.

In the Linux kernel, in the net/tls subsystem, there is no explicit prohibition of disconnecting a TLS socket. It was discovered that one can disconnect a TLS socket, leading to various unexpected corner cases, including a warning in tls_strp. The patch explicitly disallows disconnecting TLS sockets.

In the Linux kernel, the SFQ (Stochastic Fairness Queueing) scheduler lacked proper limit validation after other parameter updates. An attacker could trigger an out-of-bounds array access via specific tc command sequences, causing a system crash.

In the Linux kernel, the AMD erratum table for x86 CPUs was missing a NULL terminator, causing out-of-bounds reads. The issue was introduced during the switch from x86_cpu_desc to x86_cpu_id.

In the Linux kernel, the ppp_sync_txmung function lacks bounds checking for skb data. This can lead to out-of-bounds read with empty packets.

In the Linux kernel, a vulnerability in the JFS filesystem allows copying an nlink value of 0 from a corrupted disk inode, potentially causing a deadlock in the diFree() function when processing iag inodes.

In the Linux kernel, a use-after-free vulnerability was found in the ext4 filesystem's ext4_xattr_inode_dec_ref_all function. The issue occurs when extended attributes (xattrs) are located past the end entry, potentially leading to memory corruption.

In the venus driver (for hardware video encoding/decoding) in the Linux kernel, a missing size check in the SFR buffer allows a malicious user to modify the size in shared memory, leading to an out-of-bounds write.

In the venus driver in the Linux kernel, a missing size check for the shared queue between the driver and video firmware allows malicious firmware to set an invalid large size, leading to an out-of-bounds write.