CVE Vulnerability Catalog

In the Linux kernel, the NSM misc driver does not set the owner field in file operations, so opening /dev/nsm does not take a module reference. If the driver is a module, an open file descriptor can survive rmmod, leading to calls into unloaded code. The fix sets owner to THIS_MODULE.

In the Linux kernel tracing subsystem, there is an issue with delayed module refcount for the 'enable_event' trigger. The module refcount is released immediately while trigger data may still be used after the RCU grace period, leading to use-after-free. The fix moves the module ref release into the delayed callback.

In the Linux kernel, a vulnerability in the ublk subsystem was found where waiting on ub->completion instead of the actual device readiness (ublk_dev_ready()) can lead to a deadlock. If the ublk server sends END_USER_RECOVERY without a successful START_USER_RECOVERY, the device may be marked LIVE and the requeue list not kicked again, causing requests (e.g., flush_rq) to be stranded and blocking fsync and teardown.

In the Linux kernel for ARM64, huge_ptep_get() can be passed an unaligned virtual address, leading to incorrect determination of contiguous PTE count and potential out-of-bounds access, causing kernel panic. The fix aligns the pmdp pointer to the contpmd base before comparison.

A vulnerability was found in the Linux kernel's handling of device-private PMD entries during rmap walks. The bug causes these entries to be incorrectly treated as migration entries, potentially leading to memory corruption. Additionally, a race condition with PMD splitting can occur, worsening the issue.

In the Linux kernel, the SCTP protocol has a use-after-free vulnerability in the auth_enable sysctl during network namespace teardown. The sysctl registration was performed before the control socket was created, allowing access to a non-existent object. The fix moves sysctl registration to sctp_ctrlsock_init() and properly handles unregistration.

In the Linux kernel's libceph module, a NULL pointer dereference can occur during localized read selection when a CRUSH type name is missing. The fix skips such malformed parent buckets unless both bucket name and type name metadata are present.

In the Linux kernel's libceph module, a monmap with zero monitors was treated as valid, potentially leading to a client crash. The fix rejects such monmaps during decoding.

In the Linux kernel's libceph module, debugfs files were removed after the monitor client teardown, potentially leading to a use-after-free. The fix removes debugfs files before stopping the OSD and monitor clients.

In the Linux kernel's AMT module, delayed works could access the freed amt_dev structure after device removal. The fix uses disable_delayed_work_sync() in amt_dev_stop() to prevent re-queueing of works.

In the Linux kernel's forget_cached_acl() function, the ACL_DONT_CACHE state is not preserved, which for filesystems that opted out of ACL caching (e.g., FUSE) can lead to returning stale ACL values. The issue arises because forget_all_cached_acls() calls in FUSE code do not account for this state and remove it.

In the Linux kernel's fscrypt module, in find_or_insert_direct_key(), there is a missing comparison of the super_block pointer, causing entries in the global fscrypt_direct_keys table to be shared between different super_blocks. This can lead to a use-after-free when a key is evicted after the super_block's lifetime ends.

In the Linux kernel's fscrypt module, fscrypt_get_devices() uses dynamic allocation for an array of block device pointers, which can fail, especially during key eviction under direct reclaim. The unhandled failure leads to a use-after-free.

In the Linux kernel's iomap module, the functions ifs_set_range_dirty() and ifs_set_range_uptodate() have an out-of-bounds write vulnerability in bitmap_set() when the range length is zero. An underflow in last_blk calculation leads to huge values, causing a write beyond the allocated memory.

In the Linux kernel's slip module, slip_receive_buf() reads and writes through the rbuff pointer without holding the sl->lock, while sl_realloc_bufs() can change the buffer size. An MTU change can lead to an out-of-bounds write or use-after-free.

In the Linux kernel's geneve module, the function geneve_changelink() does not check for CAP_NET_ADMIN in the device's network namespace (dev_net(dev)), allowing a caller with privileges only in one namespace to modify a geneve device whose underlay operates in another namespace.

In the Linux kernel's net/af_iucv subsystem, there is a NULL pointer dereference vulnerability in afiucv_hs_callback_syn(). When child socket allocation fails, nsk is NULL, and the connection-refused path unconditionally calls iucv_sock_kill(nsk), leading to a crash. The fix only calls iucv_sock_kill() when a child socket was successfully allocated.

In the Linux kernel's net/iucv subsystem, there is a use-after-free vulnerability in handling severed iucv_path connections. The message_q queue holds raw pointers to the iucv_path, which is freed when the connection is severed, but notifications remain queued. Later recvmsg() uses the freed path, leading to a bug. The fix drops queued notifications when the path is severed.

A vulnerability in the Linux kernel net/sched subsystem: qdisc_get_rtab() and qdisc_put_rtab() mutate the global qdisc_rtab_list and a non-atomic refcnt without locking, which is unsafe when called without RTNL (e.g., via cls_flower). This leads to a race condition, use-after-free, and double-free of the qdisc_rate_table structure.

In the Linux kernel's PTP subsystem for s390, there is a missing facility check. The physical clock is registered without verifying that facility 28 is installed and that PTFF QAF confirms PTFF QPT availability. The fix adds the missing check.