CVE Vulnerability Catalog

In the Linux kernel TIPC subsystem, MTU validation for media and bearers lacks an upper bound check, allowing values above U16_MAX, leading to truncation and division by zero. The fix rejects MTU values above U16_MAX.

In the Linux kernel for LoongArch, the BPF JIT sign-extends signed ALU32 div/mod results, leaving upper 32 bits set, inconsistent with the verifier model. The fix adds zero-extension of the result after the divide/modulo operation.

In the Linux kernel QRTR subsystem, socket creation is not restricted to the initial network namespace, allowing unprivileged processes in other namespaces to send QRTR datagrams to sockets in other namespaces, breaking isolation. The fix confines the socket family to the initial network namespace.

In the Linux kernel, the mlx5 driver has a buffer overflow when reading the MCIA register if the device supports 32 dword reads, but the data structure only defines 12 dwords. This can lead to out-of-bounds read and kernel panic, especially with FORTIFY_SOURCE enabled.

In the Linux kernel, the RDS TCP module has a race condition during netns teardown. The sysctl is unregistered after closing the listen socket, which can lead to use-after-free in rds_tcp_skbuf_handler().

In the Linux kernel, the drop_monitor module has a size calculation error for 64-bit attributes. Underestimating the SKB buffer size can lead to a kernel panic (skb_over_panic) when adding attributes.

A use-after-free vulnerability was found in the Linux kernel's tcp_bpf_sendmsg() function in the BPF sockmap mechanism. The issue arises from an unsafe comparison of the msg_tx pointer with psock->cork after reacquiring the socket lock, which can lead to double-freeing of memory (stale cork) when two threads send concurrently on the same socket.

A use-after-free vulnerability was found in the Linux kernel's tracing subsystem, specifically in freeing trigger private data after synchronization was deferred to a separate thread. This allows a concurrent tracepoint handler to access freed memory. The fix restores synchronization for histograms and adds an optional callback for enable triggers.

In the Linux kernel xe driver, a buffer overflow was found in the steered register list allocation. The allocation size is calculated using only the geometry DSS mask, while the filling loop uses the union of geometry and compute masks, causing writes past the allocated buffer.

In the Linux kernel amdgpu driver, issues were found in context pstate override handling, including potential use-after-free and NULL pointer dereference during context initialization. Additionally, context exit may overwrite the configuration set via sysfs.

In the Linux kernel drm/xe driver, there is a use-after-free vulnerability involving imported dma-buf objects. A BO can reference the exporter's reservation object which may be freed before the importer takes a reference, leading to a system crash.

In the Linux kernel, the drm/xe/vm driver has a vulnerability where using -1 as an array index during BO VMA prefetch with CONSULT_MEM_ADVISE_PREF_LOC causes an out-of-bounds access. The fix resolves the preferred location for BO VMAs directly.

In the Linux kernel, the drm/xe/pt driver has a vulnerability where current_op is not reset in xe_pt_update_ops_init(). During retries, this can lead to out-of-bounds write and subsequent use-after-free crash. The fix resets current_op and related flags.

In the Linux kernel, the drm/imagination (powervr) graphics driver has a double call to drm_sched_entity_fini(), leading to a refcount underflow and potential use-after-free. The issue occurs during context destruction when drm_sched_entity_fini() is called both in pvr_queue_kill and pvr_queue_destroy paths.

In the Linux kernel, the drm/imagination driver has a vulnerability in pvr_set_uobj_array() where the strides for user and kernel pointers are swapped during array copying. This leads to reads/writes at wrong addresses and incorrect padding clearing.

In the Linux kernel, the drm/imagination driver has a vulnerability due to lack of synchronization between find and map operations in drm gpuvm. During map/unmap operations, a find operation may be in progress, leading to NULL pointer dereference. The fix acquires vm_ctx->lock before mapping memory.

In the Linux kernel, the drm/amdkfd driver has a vulnerability where the range of queue type and mqd size values is not checked during CRIU restore. This could lead to improper behavior or potential security issues. The fix adds appropriate checks.

In the Linux kernel, the drm/amdkfd driver has a vulnerability involving a 32-bit overflow in the CWSR total size calculation. With large ctx_save_restore_area_size and debug_memory_size multiplied by the XCC count, the product can wrap, yielding an undersized CWSR save area that firmware later overruns. The fix promotes total_cwsr_size to u64 and uses check_add_overflow()/check_mul_overflow().

In the Linux kernel, the drm/virtio driver has an out-of-bounds read vulnerability in virtio_get_edid_block(). The function validates the read offset only against the device-supplied resp->size field, not against the fixed-size resp->edid array. A malicious virtio-gpu backend can advertise a large size and high block count, leading to reads past the array and an info leak from kernel memory.

In the Linux kernel, the drm/i915/hdcp driver has a vulnerability where the bounds check for the data->streams[] array is performed after the buffer overflow has already occurred. The fix moves the check before the write, preventing memory overwrite.