CVE Vulnerability Catalog

In the Linux kernel, tcp_metrics lacks validation of the source address length for TCP_METRICS_ATTR_SADDR_IPV4. It does not check that the address is at least 4 bytes long, which may lead to improper handling.

In the Linux kernel, a vulnerability in improper extts handling in the ice driver was resolved. If the driver is removed while the ts2phc application is running, a specific extts event remains enabled and can cause a kernel crash.

In the Linux kernel, the dirty throttling logic assumed dirty limits in PAGE_SIZE units fit into 32 bits, leading to overflows and possible division by zero with very large limits (>16 TB). The fix caps the maximum limit values.

In the Linux kernel, the an30259a LED driver has a mutex initialization issue. The mutex is destroyed in the module's remove() function but may still be used by the led_set_brightness() callback invoked during automatic LED unregistration, leading to use of a destroyed mutex.

In the Linux kernel, a vulnerability was fixed in the rtw89 wifi driver where scan offload attempted to use all 6 GHz channels even when the 6 GHz sband was NULL (e.g., blocked by BIOS). NULL handling was added to avoid a crash.

In the Linux kernel, the cfg80211 subsystem did not restrict the value of the NL80211_ATTR_TXQ_QUANTUM parameter. Setting this value to 2^31 triggers a soft lockup on the CPU while processing WiFi transmit queues, leading to a system hang.

In the Linux kernel, the ice driver was fixed for a race between ice_ptp_extts_event() and ice_ptp_release() that could cause a NULL pointer dereference and kernel panic. The fix checks the PTP state and bails early if PTP is not ready.

A vulnerability was found in the Linux kernel where the 'pad' field in struct inet_diag_req_v2 is left uninitialized. The function inet_diag_get_exact_compat() converts inet_diag_req to inet_diag_req_v2 but does not initialize the 'pad' field, which is used as the protocol for raw sockets. This leads to an uninitialized value access in raw_lookup(), as reported by KMSAN.

In the Linux kernel's MediaTek vcodec driver, mtk_vcodec_mem_free() was called without checking if the buffer pointer is NULL, triggering warnings. The fix adds the missing checks.

A Cross Site Scripting (XSS) vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the 'page' parameter in php-lfis/admin/index.php.

A Cross Site Scripting (XSS) vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the first, last, and middle name fields on the User Profile page.

In the Linux kernel, the profile_pc() function on x86 has been removed. It made assumptions about stack layout to attribute time spent in spinlocks to the caller, which caused KASAN warnings and was based on outdated assumptions. The vulnerability was resolved by removing the code entirely.

In the Linux kernel, create_pinctrl() acquires pinctrl_maps_mutex before calling add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl() calls pinctrl_free(), which attempts to acquire the same mutex, leading to a deadlock.

In the Linux kernel, the WARN() call was removed from __xdp_reg_mem_model(). The warning was only triggered on memory allocation failure, which is not a critical condition requiring a warning. The issue was found by syzkaller.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the GFS2 filesystem's gfs2_log_flush function. The issue occurs when glock operations race with an unmount, causing access to a freed sd_jdesc object.

In the Linux kernel, a vulnerability was resolved in netfilter nf_tables where validation of NFT_DATA_VALUE on store to data registers was conditional. This allowed leaking a pointer to a chain object through the registers.

An incorrect access control vulnerability in the Himalaya Xiaoya nano smart speaker (rom_version 1.6.96) allows a remote attacker to have an unspecified impact. The flaw enables unauthorized access to the device.

A vulnerability was found in the Linux kernel's CXL subsystem related to automatic pmem region assembly. During CXL endpoint port probing, an attempt to auto-assemble a pmem region caused a NULL pointer dereference because the required cxl_nvd object was not yet registered. The fix changes the registration order and adds a port parameter to cxl_find_nvdimm_bridge() to query the common ancestor.

In the Linux kernel, in the NVMe over Fabrics subsystem, the use of tags for register read/write commands was changed. Previously, with many simultaneous commands, tags in the admin queue could be exhausted, potentially causing a kernel hang during a reset. The fix uses reserved tags for these operations, which is safe for the disable and enable controller paths.

In the Linux kernel on ARM64 with 64KB base pages, the PMD size (HPAGE_PMD_ORDER=13) exceeds xarray capabilities, causing a warning and failure when attempting to create a PMD-sized page cache. The fix skips allocating PMD-sized page cache when its size is larger than MAX_PAGECACHE_ORDER and falls back to the regular readahead path.