CVE Vulnerability Catalog

In the Linux kernel, in the soc: aspeed: lpc-snoop driver, the snoop_file_read function can cause a usercopy overflow due to lack of synchronization between the producer (IRQ) and consumer (file). The fix adds a per-channel spinlock to serialize kfifo access.

In the Linux kernel, in XFS, the function xfs_buf_free calls folio_put on a NULL pointer when backing memory allocation fails, leading to a kernel crash. The fix skips folio_put when bp->b_addr is NULL.

A race condition in the Linux kernel's ovpn subsystem between peer deletion and rehashing operations can resurrect already-removed peers in hash tables, leading to a use-after-free (UAF) vulnerability.

In the Linux kernel bonding driver (ALB mode), bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing promiscuity on the active slave. In that window the active slave can change, leading to a null-pointer dereference (kernel panic) or an underflow of the promiscuity counter, leaving the interface in IFF_PROMISC.

In the Linux kernel, in the enic driver, enic_remove does not cancel the tx_hang_reset work, which can lead to use-after-free after free_netdev(). The fix uses disable_work_sync() instead of cancel_work_sync() to block re-scheduling of the work.

In the Linux kernel, in IPVS, the function ip_vs_nat_icmp can write out of bounds because the ihl field in the IPv4 header is read multiple times, and a local attacker can modify the packet during processing. The fix reads ihl only once and uses ciph->len as the offset to the transport header.

A vulnerability in the Linux kernel's btrfs filesystem was found in LZO decompression for inline extents. A crafted btrfs image can trigger an out-of-bounds read (KASAN: slab-out-of-bounds) when reading a file, leading to a system crash or potential security compromise.

A memory leak was found in the Linux kernel's btrfs filesystem in the btrfs_do_encoded_write() function. During encoded write operations (ioctl), allocated extent_changeset structures are not freed before returning from the function, leading to memory leaks. The issue was discovered during local fuzzing on version 6.12.94.

In the Linux kernel, the amdxdna_insert_pages() function in the accel/amxdna driver has two error paths that incorrectly call vma->vm_ops->close(vma) before returning an error code. This causes premature resource release, and later unmapping by the process leads to a double close and reference count underflow.

In the Linux kernel BPF subsystem, when handling scalar += pointer in adjust_ptr_min_max_vals(), copying only selected fields of pointer state is fragile because pointer provenance is tracked by several bpf_reg_state fields. The fix uses the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state.

In the Linux kernel net/smc module, the smc_llc_event_handler() function lacks a check for an already pending qentry before storing a new one for CONFIRM_LINK and ADD_LINK_CONT. A malicious or buggy peer can send a second request, causing the pointer to be overwritten without freeing the previous allocation, leading to a memory leak (kmalloc-96).

In the Linux kernel devlink_nl_reload_doit() function, there is a net namespace reference leak. When the requested namespace differs from the current one and the reload action is not DRIVER_REINIT, the function returns -EOPNOTSUPP without releasing the reference obtained by devlink_netns_get().

In the Linux kernel's mlx5 driver, a vulnerability exists where the firmware tracer creation function can return either NULL or ERR_PTR. The return value is stored without a check, and during core dump generation, an invalid pointer is dereferenced, causing a kernel panic.

In the Linux kernel amdxdna_insert_pages() function in the accel/amdxdna driver, there is a BUG_ON vulnerability. The vm_flags_mod() call sets VM_MIXEDMAP and clears VM_PFNMAP, allowing an unprivileged process to call madvise(MADV_DONTNEED) on a mapped GEM object, and subsequent memory access triggers BUG_ON in vmf_insert_pfn_prot() due to pfn_valid(pfn) and VM_MIXEDMAP.

A vulnerability in the Linux kernel's BPF conntrack kfuncs was found, where the opts argument can point to a shared map value. Inconsistent reads of the netns_id field during acquisition and release of network namespace references can lead to reference imbalance, potentially destroying a live namespace and crashing the system.

A use-after-free vulnerability was found in the Linux kernel's bpf_iter_tcp_established_batch() for TCP_NEW_SYN_RECV sockets. The request_sock is published on the ehash chain before its refcount is set, and the BPF iterator uses plain sock_hold() instead of refcount_inc_not_zero(), leading to a race that overwrites the refcount and causes use-after-free.

A vulnerability in the Linux kernel's vhost_iotlb mechanism allows IOTLB entries to be allocated beyond the configured limit, leading to uncontrolled memory consumption. Affected components include vhost, vDPA, VDUSE, and vhost-vDPA devices that may create tables with zero or no limits. The fix enforces the limit and rejects invalid values.

In the Linux kernel, a vulnerability in the vdpa/mlx5 driver leads to a slab-out-of-bounds read. The issue is caused by incorrect calculation of the input buffer size in create_direct_keys(), resulting in reading 16 bytes beyond the allocated region.

A type confusion vulnerability was found in the Linux kernel's hwmon driver for PMBus devices. The pmbus_notify() function incorrectly casts different attribute types to sensor_device_attribute, which may lead to an out-of-bounds read or incorrect mask matching during alerts. The fix changes the attribute structures and sets the index to -1 for attributes that do not trigger notifications.

In the Linux kernel, AF_XDP accepts a TX metadata length as small as eight bytes, but every supported request needs flags plus at least one eight-byte field. Such short metadata can let the kernel read beyond the registered area.