CVE Vulnerability Catalog

In the Linux kernel, a use-after-free (UAF) vulnerability was found in the BFQ scheduler. The issue involves moving the oom_bfqq queue, which can lead to a write to freed memory during module removal.

In the Linux kernel, a bug in the memstick/mspro_block driver regarding read-only devices was fixed. Instead of checking for read-only state in ->open and leaking a reference in case of a read-only device, set_disk_ro is used to propagate the read-only state to the block layer.

A use-after-free vulnerability was found in the bfq_dispatch_request function of the BFQ scheduler in the Linux kernel. The issue occurs during normal SCSI-MQ testing and can lead to memory corruption.

In the Linux kernel for the parisc architecture, a vulnerability was found involving non-access data TLB cache flush faults. The fdc and fic instructions in flush_user_dcache_range_asm and flush_user_icache_range_asm cause faults that do not invalidate the cache line, potentially leading to memory corruption. The problem was hidden by nullification of the flush instructions.

In the Linux kernel, the F2FS filesystem lacked validation of the curseg->alloc_type value, which could lead to an out-of-bounds access to the sbi->block_count[] array when mounting a corrupted image, triggering a UBSAN error. The issue was reported by Wenqing Liu and affected kernel versions 5.17-rc4 and 5.17-rc6.

In the Linux kernel, the btrfs filesystem has a double bio completion issue during errors in compressed reads. The function btrfs_submit_compressed_read() may call bio_endio() on the bio, and then btrfs_submit_data_bio() does it again, leading to incorrect behavior.

In the Linux kernel, the imx-jpeg media driver has an out-of-bounds array access bug. During a JPEG parsing error, the slot is not yet acquired and may have the default value MXC_MAX_SLOTS, leading to out-of-bounds read and modification of adjacent data.

In the Linux kernel, a bug in the sm712fb driver (video: fbdev) caused a crash when writing three bytes to the framebuffer. The issue occurred in the smtcfb_write() function and was caused by an error in the endianness conversion code. The fix removes the open-coded endianness fixup-code.

In the Linux kernel, the SCSI qla2xxx driver incorrectly freed a pre-allocated structure during purex packet handling, causing a system crash during module load/unload tests. The fix skips that entry.

In the Linux kernel, the qla2xxx SCSI driver has a race condition between the timeout handler and the async completion function, leading to use-after-free and a NULL pointer dereference. The fix introduces a reference counter for the SRB structure to synchronize access.

In the Linux kernel, the Bluetooth subsystem (hci_event) ignores multiple connection complete events for the same handle. Previously, this led to multiple device registration and memory corruption.

In the Linux kernel, the mt76/mt7921 driver has a crash vulnerability when the network interface fails to start. If startup fails, the scheduled reset_work may execute after memory cleanup, leading to a use-after-free. The fix cancels the work item before cleanup.

In the Linux kernel's SCSI libfc driver, there is a use-after-free vulnerability in fc_exch_abts_resp(). fc_exch_release(ep) decreases the reference count, and when it reaches zero, the object is freed, but it is still used in subsequent code, leading to use-after-free.

In the Linux kernel, the netfilter conntrack module has an issue with garbage collection autotuning. The change in gc behavior causes netlink event overflows when the hash table is large. The fix adjusts the gc schedule to avoid overflows.

In the Linux kernel's qede driver, a vulnerability exists where skb allocation is not confirmed before use. qede_build_skb() assumes build_skb() always works, but it can fail under memory pressure, causing a kernel panic. The fix adds a check for NULL return from build_skb().

In the Linux kernel, a NULL dereference crash in the svc_deferred_event trace class in SUNRPC was fixed, occurring when an svc_rqst is deferred while sunrpc tracing is enabled.

In the Linux kernel, in Hyper-V drivers (vmbus), sysctl_record_panic_msg is now deactivated by default in isolated guests. The panic page may contain guest-sensitive information, so it is no longer dumped to Hyper-V by default. Comments in hyperv_panic_event and hyperv_die_event were also updated.

In the Linux kernel IPv6 module, there is a kernel panic vulnerability when forwarding a packet if the input interface has no associated in6 dev. This can be triggered using tc commands with netem corrupt.

In the Linux kernel, the dm-integrity module has a memory corruption vulnerability when the tag_size parameter is smaller than the actual digest size. This can cause writes beyond the end of the ic->recalc_tags array, leading to memory corruption. The issue is fixed by increasing the tags array with sufficient padding.

In the Linux kernel, a vulnerability related to the BFQ scheduler was fixed, which could lead to use-after-free (UAF). The commit regarding honoring already-setup queue merges was restored after being reverted, as the bug was fixed in another commit.