CVE Vulnerability Catalog

A vulnerability in the Linux kernel causes a hang in nfsd4_shutdown_callback when an NFS client is in courtesy state, blocking for up to 15 minutes until TCP drops the connection.

In the Linux kernel's AX25 stack, a reference count leak occurs when using the SO_BINDTODEVICE socket option. The refcount is decremented in ax25_release but not incremented when binding via this option, causing a warning and potential memory leak.

In the Linux kernel's LoongArch architecture, the IP checksum function for negative lengths causes undefined bit shift and out-of-bounds memory read, potentially leading to crash or data leak.

In the TI AM65 CPSW Ethernet driver in the Linux kernel, there is a memory leak when the XDP program does not return XDP_PASS. Memory allocated by am65_cpsw_build_skb() was not freed, and allocating SKB before running the XDP program wasted CPU cycles. The fix moves SKB allocation after evaluating the XDP result.

In the Linux kernel for ARM64, a vulnerability was found in the cacheinfo subsystem due to an out-of-bounds write to the cacheinfo array. The detection loop did not account for cache levels with separate data/instruction caches, causing an out-of-bounds write.

In the Linux kernel, a buffer overflow vulnerability was found in the amdgpu driver's smu_sys_set_pp_table() function. A malicious user can provide a small pptable via sysfs followed by a larger one, leading to a buffer overflow attack.

A vulnerability was found in the Linux kernel's mmap mechanism for persistent ring buffers used in tracing. Attempting to mmap a trace instance buffer attached to reserve_mem causes a page fault and system crash. The issue arises because virt_to_page is used on vmap'd memory, which is invalid.

A vulnerability related to the handling of bogus partition tables has been fixed in the Linux kernel. Issues included improper sector size and lack of proper NUL termination in the partition table.

In the Linux kernel, the __ip_rt_update_pmtu() function for IPv4 lacked RCU protection when reading the network structure (net). This can lead to a race condition and access to already freed memory.

In the Linux kernel, a vulnerability was found in the ip6_default_advmss() function, which lacked RCU protection when reading the network structure. This could lead to a use-after-free condition.

A vulnerability was found in the Linux kernel's ndisc_alloc_skb() function, which can be called without holding RTNL or RCU locks. Lack of proper RCU protection may lead to a use-after-free (UAF) condition.

A vulnerability has been identified in the Linux kernel in the __neigh_notify() function, which can be called without RTNL or RCU protection. A fix has been implemented to use RCU protection to avoid potential use-after-free (UAF) issues.

A vulnerability has been identified in the Linux kernel in the arp_xmit() function, which can be called without RTNL or RCU protection. A fix has been implemented to use RCU protection to avoid potential use-after-free (UAF).

A vulnerability has been identified in the Linux kernel in the function ovs_vport_cmd_fill_info(), which can be called without proper RCU or RTNL protection. Using RCU protection and dev_net_rcu() helps avoid potential use-after-free (UAF) errors.

In the Linux kernel, a vulnerability was found in the ndisc_send_skb() function, which can be called without RTNL or RCU lock. The lack of proper RCU protection allows a use-after-free (UAF) when accessing the device's network namespace.

In the Linux kernel, the mld_newpack() function lacked RCU protection, potentially causing data races. The fix replaces sock_alloc_send_skb() with alloc_skb() and charges the socket under RCU protection.

A vulnerability related to virtual socket (vsock) handling has been resolved in the Linux kernel. The issue was improper management of socket bindings, leading to a use-after-free error during transport reassignment.

A vulnerability has been identified in the Linux kernel within the btrfs filesystem, which involves a use-after-free error when attempting to join an aborted transaction. The issue arises when reading the 'aborted' field after unlocking trans_lock, potentially leading to unsafe memory access.

W jądrze systemu Linux zidentyfikowano podatność związana z użyciem po zwolnieniu pamięci w funkcji inicjalizacji. Problem występuje podczas zwalniania urządzenia platformowego, co prowadzi do sytuacji use-after-free w kontekście profilu kryptograficznego UFS.

In the Linux kernel, the libata-sff subsystem has a bug that allows writing outside the allocated buffer during ATA PIO command handling. The ata_pio_sector() function lacked a bounds check, unlike the similar __atapi_pio_bytes() function. This can lead to overwriting random memory.