CVE Vulnerability Catalog

A bug in the Bluetooth btnxpuart driver in the Linux kernel causes a kernel panic during firmware release. The issue occurs in a stress test scenario where WLAN and BT firmware are downloaded simultaneously, and due to a hardware bug, the chip sends only one bootloader signature. After a 60-second timeout waiting for the next signature, calling release_firmware triggers a kernel panic.

In the Linux kernel, the panthor DRM driver has a race condition when gathering fdinfo group samples. Lack of protection for group access with an xarray lock can lead to use-after-free.

In the Linux kernel, the powerpc/perf module lacks module ownership assignment for the 'vpa_pmu' PMU. This allows unloading the module while perf events are active, leading to a NULL pointer dereference and kernel panic.

In the Linux kernel PAT (Page Attribute Table) mechanism for x86, a bug was found in handling the VM_PAT flag during a failed fork() call. When track_pfn_copy() fails, the VM_PAT flag remains set for the destination VMA, causing an attempt to read PAT information from uncopied page tables, triggering a WARNING and potential system crash.

A vulnerability in the Linux kernel's RDMA/core subsystem caused hardware counters (hw_counters) to be exposed to non-initial network namespaces. Attempting to read these counters in such a namespace resulted in a NULL pointer dereference and kernel panic.

In the Linux kernel BPF subsystem, the may_goto instruction uses an extra 8 bytes on the stack, causing the interpreters[] array index calculation to go out of bounds.

In the Linux kernel MLX5 driver, a bug in mlx5_poll_one() incorrectly compares the QP number from CQE with the QP number in mlx5_ib_qp instead of mlx5_core_qp. This causes the wrong QP to be used when handling a CQE, potentially leading to a NULL pointer dereference and system crash.

In the Linux kernel's vhost-scsi subsystem, multiple bugs were found when vhost_scsi_set_endpoint is called multiple times without an intervening vhost_scsi_clear_endpoint. These bugs can cause use-after-free, hang during TPG directory removal, and TPG leaks, making them unremovable.

In the NTFS3 filesystem in the Linux kernel on 32-bit systems, an integer overflow occurs when adding 'off + sizeof(struct NTFS_DE)'. This can lead to incorrect behavior.

In the NTFS3 filesystem in the Linux kernel, the hdr_first_de() function does not properly validate the 'de_off' and 'used' values from disk. On 32-bit systems, this can lead to integer overflow bypassing checks.

In the OCFS2 filesystem in the Linux kernel, the l_tree_depth field (16-bit) is not validated before use, potentially causing out-of-bounds access if it has an invalid value (e.g., from a corrupted disk). Maximum depth is limited to OCFS2_MAX_PATH_DEPTH.

In ksmbd (SMB server in the Linux kernel), the r_count counter is only incremented during oplock break wait but decremented elsewhere, causing a mismatch. This can make r_count negative, preventing the ksmbd thread from terminating.

In the Linux kernel's spufs (Cell Broadband Engine), there are lifetime management bugs in gang directories. A previous patch incorrectly removed dentry pinning, leading to unbalanced dput() calls and link count leaks.

W jądrze Linuxa naprawiono podatność związaną z nieprawidłowym układem stosu w architekturze riscv, co prowadziło do ostrzeżenia 'Bad frame pointer' podczas testów ftrace. Problem ten występował podczas wykonywania skryptu ftrace_stress_test.sh.

In the Linux kernel, a vulnerability was found in the SCTP protocol due to missing mutual exclusion in proc_sctp_do_udp_port(). Concurrent calls to sctp_udp_sock_stop() and sctp_udp_sock_start() can cause a race condition, leading to a NULL pointer dereference and system crash, as reported by syzbot.

In the Linux kernel's Airoha network driver, a bug in airoha_tc_get_htb_get_leaf_queue() causes incorrect queue ID (qid) reporting. This triggers a kernel warning and potential crash when deleting offloaded HTB leafs or root HTB qdisc.

A vulnerability in the Linux kernel's UDP implementation allows multiple integer overflows of the sk->sk_rmem_alloc counter. By setting a large sk->sk_rcvbuf (e.g., INT_MAX) and flooding packets, an attacker can cause the counter to overflow, enabling a single socket to hold excessive data.

In the Linux kernel's dst_release function, cached dst counters are not properly decremented (when CONFIG_DST_CACHE is enabled). This can lead to accessing freed memory during netns dismantle, causing a kernel panic.

In the Linux kernel netfilter nft_tunnel module, a vulnerability was found due to incorrect pointer arithmetic when processing GENEVE attributes. A type confusion before pointer addition leads to a heap out-of-bounds write.

A vulnerability in the Linux kernel allows integer overflow in the geneve_opt structure. An attacker can use a 128-byte option to fake a zero-length option, leading to a heap out-of-bounds read.