CVE Vulnerability Catalog

In the Linux kernel, the xcrb_msg_to_type6cprb_msgx() function for s390/zcrypt lacks proper input validation, leading to integer overflow, missing minimum size validation, and arithmetic overflow in sum calculations. This can result in undersized buffer allocations, uninitialized memory access, and buffer overflows.

In the Linux kernel, the xcrb_msg_to_type6_ep11cprb_msgx() function for s390/zcrypt lacks minimum size validation, has arithmetic overflow in length calculations, and improper ASN.1 payload parsing. This can lead to uninitialized memory access and buffer overflows.

In the Linux kernel, the zcrypt_msgtype6_send_ep11_cprb() function for s390/zcrypt uses fragile struct overlays to access and modify the domain field in the EP11 CPRB payload, causing maintainability and security concerns. It lacks validation of actual ASN.1 encoding and has error-prone length format detection.

In the Linux kernel, the xcrb_msg_to_type6cprb_msgx() and xcrb_msg_to_type6_ep11cprb_msgx() functions for s390/zcrypt copy a user space message into a kernel buffer based on length, but further processing assumes 4-byte alignment. As a result, up to 3 bytes of uninitialized kernel memory are forwarded to further processing, potentially exposing kernel memory to the crypto card firmware.

In the Linux kernel, the amdgpu driver for AMD Display has a NULL pointer dereference in amdgpu_dm_crtc_set_vblank() when vblank is enabled or queried before a stream is attached to acrtc_state->stream. This can lead to a system crash.

In the Linux kernel, the amdgpu driver's AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, causing amdgpu_bo_placement_from_domain() to exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON().

In the Linux kernel, the amdgpu driver incorrectly calculates the minimum size for UVD decode images because it uses width instead of pitch. Additionally, it does not reject pitch over 4096, which could lead to overflow.

In the Linux kernel, the amdgpu driver's amdgpu_cs_pass1() does not reject repeated chunk IDs, allowing multiple FENCE chunks in one submit. This causes amdgpu_cs_p1_user_fence() to run twice, overwriting p->uf_bo and leaking a BO reference.

In the Linux kernel, the XFS filesystem's xfs_rtginode_ensure() treats every error from xfs_rtginode_load() other than -ENOENT as success. This can leave the realtime group inode unset after an I/O, allocation, or corruption error, and growfs continues as though the inode had been loaded.

In the Linux kernel, the XFS filesystem has a vulnerability due to an off-by-one error in the validation of the root level of the rtrefcount B-tree. A crafted filesystem image with metadir, realtime, and reflink enabled can cause a slab-out-of-bounds write during mount or recovery, leading to a kernel panic.

In the Linux kernel XFS filesystem, during log recovery, the function xlog_recover_do_reg_buffer() copies data into a buffer based on a dirty bitmap without proper bounds checking. An attacker can supply a crafted filesystem image that causes an out-of-bounds write and corrupts the kernel heap. The issue is fixed by replacing the ASSERT with a real XFS_IS_CORRUPT() check that aborts recovery with -EFSCORRUPTED.

In the Linux kernel XFS filesystem, during directory tree repair, a self-referential directory may be detected. In such a case, the repair code attempts to lock the same inode twice (double iolock/ilock), leading to a deadlock. The fix detects this corner case and handles it appropriately.

In the Linux kernel XFS filesystem, the function xfs_dq_get_next_id() acquires the ILOCK on the quota inode before calling xfs_iread_extents(). If xfs_iread_extents() fails, the function returns without releasing the lock, causing a lock leak. This can leave the quota inode locked and cause subsequent quota operations to hang.

In the Linux kernel XFS filesystem, during AGI repair, the function xrep_iunlink_walk_ondisk_bucket may attempt to use the pointer sc->sa.agi_bp, which can be null if the buffer verifier fails. The fix uses ragi->agi_bp instead, which skips verifier checks, to avoid walking off the end of memory.

In the Linux kernel XFS filesystem, during online fsck, the function xrep_iunlink_resolve_bucket is still vulnerable to infinite loops coming from next_unlinked pointers. The fix remembers which inodes have already been seen and checks new agino pointers against that to detect loops.

In the Linux kernel XFS filesystem, the function xrep_tempfile_create can lead to a use-after-free (UAF) if the tempfile creation code fails after setting sc->tempip. The fix addresses this issue.

In the Linux kernel XFS filesystem, during exchange-range operations with the XFS_EXCHMAPS_INO1_WRITTEN flag, the function xmi_can_exchange_reflink_flags() may move the reflink flag to another file, but not all mappings are exchanged, which can lead to clearing the reflink flag on a file that still has shared written extents. This can result in data corruption. The fix disables the reflink flag exchange when XFS_EXCHMAPS_INO1_WRITTEN is requested.

In the Linux kernel XFS filesystem, the function xlog_recover_dquot_commit_pass2() validates the recovered dquot with xfs_dqblk_verify(). On failure, it sets error = -EFSCORRUPTED and jumps to out_release, but out_release unconditionally returns 0, so the error is discarded. This allows a corrupt quota buffer to be written back to disk.

In the Linux kernel, a vulnerability in Ceph was found where handle_reply() stores a ceph_mds_request pointer in current->journal_info while populating inode and dentry caches. An allocation in this section can trigger direct reclaim, pruning dentries from another filesystem, which may start a JBD2 transaction in ext4. JBD2 misinterprets the Ceph pointer as a journal handle, causing a kernel crash.

A vulnerability in the Linux kernel's Ceph filesystem can cause read operations to hang indefinitely. The issue stems from an incorrect mds_wanted flag state, where a client may wait forever for FILE_RD rights after they were revoked by the MDS. The patch introduces a bounded wait and forces a synchronous OPEN renew when the required caps are not actually held.