CVE Vulnerability Catalog

In the Linux kernel, the md/raid1 and md/raid10 drivers have been fixed for a deadlock in the read error recovery path. Resubmitting a split md cloned bio can lead to a deadlock if the array is suspended, because trying to acquire another active_io reference via percpu_ref_tryget_live() may block.

In the Linux kernel, the md/raid1 and md/raid10 drivers have been fixed to detect the error path using md_cloned_bio() instead of relying on r1_bio or r10_bio->read_slot, which may be NULL or -1 after splitting and resubmitting a failed bio. The previous logic could lead to using GFP_NOIO instead of (GFP_NOIO | __GFP_HIGH), potentially causing a deadlock under memory pressure.

In the Linux kernel, the md/raid1 and md/raid10 drivers have been fixed for bio accounting of split md cloned bios. Instead of relying on r1bio_existed in raid1 or the io_accounting flag in raid10, md_cloned_bio() is used to control accounting, avoiding double accounting or missing accounting.

In the Linux kernel, the raid1 driver has been fixed for an nr_pending leak in the REQ_ATOMIC bad-block error path. In raid1_write_request(), each loop iteration increments rdev->nr_pending, but if a badblock is encountered, the code jumps to err_handle without decrementing the counter for the current mirror, leading to a permanent leak and preventing rdev removal.

A vulnerability in the Linux kernel's BPF_PROG_QUERY causes an out-of-bounds write when writing the 'query.revision' field to userspace. This occurs when userspace passes a smaller bpf_attr structure (e.g., 40 bytes, before the revision field was added), leading to a write beyond the allocated buffer. The fix propagates the user-provided attribute size to cgroup query handlers and conditionally skips writing the revision field when the buffer is too small.

In the Linux kernel, a TOCTOU race in luo_session_retrieve() of the liveupdate mechanism has been fixed. The rwsem_read lock scope was extended to overlap with the session mutex acquisition, preventing a concurrent thread from releasing and freeing the session between lookup and mutex lock.

In the Linux kernel, a use-after-free vulnerability in luo_file_unpreserve_files() and luo_file_finish() of the liveupdate mechanism has been fixed. The patch reorders module_put() and xa_erase() to ensure the file handler module remains pinned while its operations are accessed, preventing use of freed memory.

In the Linux kernel, a memory leak in the ath12k WiFi driver has been fixed in ath12k_wifi7_dp_rx_h_verify_tkip_mic(). When NWIFI header length validation fails, the function aborts with an error and the corresponding MSDU is never freed, leading to a memory leak.

In the Linux kernel, issues in ath12k_mac_vdev_create() of the ath12k WiFi driver have been fixed, which left the arvif object in an inconsistent state on error paths. The patch adjusts the control flow to ensure proper cleanup on vdev creation failures.

A vulnerability in the ath12k Wi-Fi driver causes a NULL pointer dereference during link operations when a channel validation fails and the driver is not properly initialized. This leads to a kernel crash when subsequent operations attempt to use uninitialized structures.

In the Linux kernel, a vulnerability in the BTT (Block Translation Table) mechanism for NVDIMM has been fixed, related to preemption during lane acquisition. The previous spinlock-based recursion model was invalid after lanes became preemptible, potentially leading to silent data corruption. The fix replaces the spinlock with a dynamically allocated per-lane mutex array.

In the Linux kernel, a vulnerability in the BPF mechanism has been fixed that allowed bypassing the exclusivity guarantee of BPF maps. Exclusive maps (created with excl_prog_hash) could be inserted into outer maps (map-of-maps) and mutated by unrelated programs, bypassing program compatibility checks.

In the Linux kernel, a use-after-free vulnerability in the bpffs filesystem has been fixed. A previous patch moved inode cleanup from free_inode() to destroy_inode(), removing the RCU delay and allowing access to freed memory during concurrent RCU pathwalk. The fix restores RCU-delayed freeing of the inode and the i_link buffer.

In the Linux kernel, a vulnerability in the ext2 filesystem has been fixed where the return value of generic_write_sync() was ignored in ext2_dio_write_iter(). The fix ensures error propagation, preventing write(2) from returning success when the sync failed.

In the Linux kernel, a vulnerability in the NVMe driver has been fixed regarding an incorrect bounds check for the fdpcidx index in the FDP (Flexible Data Placement) mechanism. The bug used > instead of >=, incorrectly accepting an index equal to NUMFDPC + 1.

In the Linux kernel, a vulnerability was found in the bpf_map_elem iterator mechanism. These iterators bind their target map at attach time, bypassing the exclusivity check for maps, allowing access to maps intended only for a single program. Additionally, the iterator exposes the map value as a writable buffer.

In the Linux kernel, configfs_lookup() has a bug that leaves a dangling ->s_dentry pointer when inode allocation fails. This leads to a use-after-free during subsequent getdents(2) operations in the directory.

In the Linux kernel, the ext4 filesystem has a bug in the wait/wake bit mapping for fast commit on 64-bit architectures. The wait and wake functions used raw EXT4_STATE_* values instead of the appropriate +32 offset, causing incorrect synchronization.

In the Linux kernel, a vulnerability in the amdgpu driver causes a slab-out-of-bounds write during coredump generation after a GPU reset. The issue stems from a race condition between two loops processing GPU rings, where the ring count can change between counting and copying.

In the Linux kernel, the vhost subsystem's vhost_get_avail_idx returns an incorrect value, indicating all entries consumed instead of an index update. This can lead to host livelock when the guest is not making progress, as vhost immediately disables notifications and retries.