CVE Vulnerability Catalog

In the Linux kernel's netfilter subsystem (nf_conncount), a vulnerability was found due to uninitialized fields in the `nf_conncount_tuple` structure within the `insert_tree()` function. Missing initialization of `cpu` and `jiffies32` fields can lead to undefined behavior, including information leaks or system crashes.

In the Linux kernel, the openvswitch module reverted a commit that introduced per-action label counting in conntrack. The new implementation caused a warning when trying to allocate the labels_ext extension for a confirmed conntrack entry, which occurred when the entry was created before OVS incremented the labels_used counter.

In the Linux kernel's ksmbd module (SMB server), a vulnerability allows connection release during oplock break notification, potentially leading to use-after-free in the ksmbd_work structure.

In the Linux kernel for LoongArch architecture, a bug was found in hugetlb memory mapping handling. The base address allocated from hugetlbfs was not aligned to PMD (Page Middle Directory) size, causing an internal kernel BUG during huge page operations. The issue is fixed by adding a check and enforcing proper base address alignment.

W jądrze systemu Linux zidentyfikowano podatność związaną z ksmbd, która dotyczy pomyłki typów spowodowanej warunkiem wyścigu podczas używania ipc_msg_send_request. Problem polega na tym, że req->handle może być przydzielany w sposób, który prowadzi do nieprawidłowego dostarczenia wiadomości, co skutkuje dostępem do nieoczekiwanych obszarów pamięci.

In the Linux kernel's ksmbd module (SMB server), an out-of-bounds read vulnerability exists in the parse_sec_desc() function due to improper validation of offsets (osidoffset, gsidoffset, dacloffset), potentially leading to slab-out-of-bounds.

In the Linux kernel's ksmbd module (SMB server), a use-after-free vulnerability exists in the smb2_lock function. When smb_lock->zero_len has a value, the llist is not deleted and flock remains old, leading to use-after-free during error handling.

In the Linux kernel's drm/xe/hmm driver, a vulnerability allows dereferencing struct page pointers without holding the notifier lock. This can lead to marking pages as dirty/accessed that we don't own and dereferencing pages we don't own.

A vulnerability in the Linux kernel's MPTCP implementation allows concurrent connection requests to trigger synchronize_rcu in an atomic context (e.g., during packet reception in an RCU read-side critical section). This causes a 'scheduling while atomic' error and potential system hang.

In the Linux kernel, a vulnerability in vma_modify() causes incorrect VMG state after a failed merge due to out-of-memory (OOM), leading to invalid start/end values in subsequent VMA splits and triggering a VM_WARN_ON_VMG assertion.

In the Linux kernel, the __udp_gso_segment function removes the skb destructor without removing the socket reference, causing a kernel BUG when the original skb is later orphaned. This issue is triggered in Open vSwitch scenarios with specific action sequences.

In the Linux kernel's hns3 network driver (Huawei), a vulnerability exists where the PTP (Precision Time Protocol) clock is not unregistered and freed if hclge_ptp_get_cycle returns an error, leading to resource leaks.

In the Linux kernel scheduler CFS, a potential memory corruption vulnerability was found in the child_cfs_rq_on_list function. The issue stems from an invalid conversion of the 'prev' pointer from the rq's leaf_cfs_rq_list, potentially causing memory faults or garbage data access.

In the Linux kernel CDX driver (drivers/cdx/cdx.c), driver_override_show() reads the driver_override field without locking, while driver_override_store() can modify it, freeing the old value. This can lead to a use-after-free (UAF) and potential kernel address leak.

In the Linux kernel, the Slimbus messaging subsystem has a bug where the transaction ID (TID) is not freed when slim_do_transfer() returns a timeout error due to delayed interrupts. This leads to invalid memory access in qcom_slim_ngd_rx_msgq_cb() and a kernel panic.

In the Linux kernel's iwlwifi Wi-Fi driver (Intel), a vulnerability exists where the IWL_MVM_STATUS_ROC_P2P_RUNNING flag is not set when firmware fails to start session protection. This leads to improper cleanup and a WARN() on subsequent remain-on-channel attempts.

In the Linux kernel, the RDMA bnxt_re driver lacks sanity checks on the rdev pointer. The ulp_irq_stop and ulp_irq_start callbacks can be called when the device is detached, leading to a NULL pointer dereference and system crash.

In the Linux kernel, NFSv4 has a deadlock when recovering state for a sillyrenamed file. The put_nfs_open_context() call can trigger a synchronous delegreturn that deadlocks because it is not marked as privileged.

In the Linux kernel, a vulnerability in the tracing subsystem allows a malformed histogram trigger (hist) to corrupt the named_triggers list. After a failed trigger creation with an invalid action (onmax(bogus)), the data structure is freed but remains on the list, causing a use-after-free bug and potential system crash.

In the Linux kernel FUSE filesystem, the switch to new folio-based readahead code caused the folio reference to be dropped after locking. In splice responses, where the old folio is removed and replaced, the missing reference leads to a use-after-free (UAF).