CVE Vulnerability Catalog

In the Linux kernel, the qede driver had an out-of-bounds check issue in cqe->len_list[], where the index check was performed after element access. The fix moves the index check before the access.

In the Linux kernel, the accel/amdxdna driver had a race condition regarding the iommu domain lifetime during device removal. In force_iova mode, accessing xdna->domain after device removal could lead to use-after-free. The fix moves domain freeing to a managed release action, ensuring its validity until all resources are released.

In the Linux kernel, the parse_btf_arg function in tracing/probes contained a WARN_ON_ONCE that users could easily trigger by adding a kprobe event based on a raw address with BTF parameter. Since this is not an unexpected condition, the warning was removed.

In the Linux kernel, a vulnerability was found in the DRM driver for Intel GPUs (xe). With CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y enabled, xe_pt_svm_userptr_pre_commit() calls vma_check_userptr() with notifier_lock held in read mode, while the test path requires write mode. This triggers an assertion and a WARNING in drm_gpusvm_unmap_pages(), potentially destabilizing the system.

In the Linux kernel, the HID picolcd driver had a potential NULL pointer dereference in picolcd_send_and_wait() due to an integer overflow of the signed loop counter. Changing the counter type to unsigned int prevents the overflow and eliminates the out-of-bounds access.

In the Linux kernel, the hid_get_report function in HID core had an out-of-bounds read issue for numbered reports when the data size was 0. The fix moves the minimum size validation before calling hid_get_report, preventing out-of-bounds pointer dereference.

In the Linux kernel, the parse_dcc() function in netfilter nf_conntrack_irc had an off-by-one error leading to an out-of-bounds read. It treated the end pointer as inclusive, while the caller passed a pointer one past the last valid byte. The fix changes the loop to strict less-than, consistent with the caller's convention.

A vulnerability in the Linux kernel's perf subsystem for AMD processors leaks kernel addresses to user space. Even when PERF_SAMPLE_BRANCH_USER is requested, the branch stack may contain entries with branch-from addresses in the kernel (e.g., for SYSRET/ERET). The issue affects AMD processors with X86_FEATURE_AMD_LBR_V2, where the hardware filter only considers the privilege level of the branch target.

In the Linux kernel, the batman-adv gw module does not reassign the ethernet header pointer after pskb_may_pull() reallocates the buffer. This can lead to a use-after-free condition.

In the Linux kernel, the batman-adv dat module does not reassign the ARP hardware source pointer after pskb_may_pull() reallocates the buffer. This can lead to a use-after-free condition.

In the Linux kernel, the batman-adv batadv_dat_get_vid() function does not verify that the proto field of the ethernet header is accessible before reading it. This could lead to an out-of-bounds read.

In the Linux kernel, the NTFS3 filesystem's decompress_lznt() function does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read.

In the Linux kernel, the mtd maps vmu-flash driver does not link the device structure to its parent, causing a NULL pointer dereference during MTD initialization.

In the Linux kernel, the ims-pcu driver exposes sysfs attributes on all interfaces, but only supports them on the control interface. Accessing these attributes on data interfaces can lead to unexpected behavior or crashes.

In the Linux kernel, the ims-pcu driver processes response data from device buffers without verifying that the device actually sent enough data. This can lead to out-of-bounds reads or processing stale data.

In the Linux kernel, the ims-pcu driver does not verify that the bLength of each descriptor is at least 2 when parsing CDC union descriptors. A malicious device could provide a descriptor with bLength=0, leading to an infinite loop.

In the Linux kernel, the hwmon asus_atk0110 driver's atk_ec_present() function does not check that the sub-package is non-empty before reading its first element. This can lead to an out-of-bounds read.

A vulnerability in the Linux kernel's DAMON mtier sample module can trigger a WARN_ONCE() in damon_new_region() when address range parameters are invalid. This occurs if the module is enabled before node{0,1}_{start,end}_addr are initialized or if a node is memoryless. The fix adds early validation of parameters before region creation.

In the Linux kernel, a vulnerability was found in the f2fs filesystem's f2fs_listxattr() function. Lack of validation of xattr entries before reading their fields may result in returning a partial result instead of an error when an entry is outside the valid storage area.

A vulnerability in the Linux kernel's IP fragmentation stack allows an attacker to send IP fragments with GSO metadata (e.g., via tun/tap), causing a kernel panic (BUG_ON in skb_segment) after reassembly. It affects IPv4, IPv6, nf_conntrack, and 6lowpan reassembly paths.