CVE Vulnerability Catalog

In the Linux kernel, the iommu/vt-d subsystem has a bug causing RB-tree corruption in the probe error path. If a device does not support ATS, the RB node remains zeroed, and on a subsequent probe failure, the removal misinterprets it as a tree root, corrupting the tree.

In the Linux kernel, a vulnerability in the zap_pages() function in BPF was fixed, which required holding mmap_lock. Previously, improper locking could lead to synchronization issues and potential use-after-free during memory map operations.

In the Linux kernel, a problem in the amdkfd graphics driver was fixed where good queues were not properly restored after a failed suspend_all. Now resume_all is always executed after suspend_all, and remove_queue is performed even on failure.

In the Linux kernel, a use-after-free vulnerability in the reserved memory mechanism was fixed. When alloc_reserved_mem_array() fails, the global pointer reserved_mem still references memory in the __initdata section, which after initialization can lead to dereferencing freed memory.

In the Linux kernel, a use-after-free vulnerability was found in the OCFS2 debugfs locking_state iterator. The iterator copies the ocfs2_lock_res structure, but the LVB pointer (sb_lvbptr) still points to the original object, which can be freed before the data is read, leading to access to freed memory.

In the Linux kernel, a vulnerability in the OCFS2 filesystem was found due to missing validation of fast symlinks during inode read. A corrupted inode with a zero-cluster symlink can cause an out-of-bounds read beyond the inode block buffer, leading to a use-after-free error.

In the Linux kernel, a vulnerability in the OCFS2 filesystem was fixed where FITRIM accepted ranges shorter than the cluster size, leading to arithmetic underflow and potential trimming beyond the requested range. Now ranges shorter than the cluster size are rejected.

In the Linux kernel, a use-after-free vulnerability was found in the OCFS2 filesystem's debugfs locking_state mechanism. The debug_lockres_open() function ignores the return value of dlm_grab(), allowing a raw pointer to a freed dlm_ctxt structure to be stored and later used in debug_lockres_release() after domain unregistration. This leads to a slab-use-after-free condition reported by KASAN.

In the Linux kernel, a vulnerability in the netfilter cttimeout module was fixed by changing reference counting for timeout policies. Now the refcount is only used for conntrack entries, allowing immediate removal of policies from nfnetlink_cttimeout.

In the Linux kernel, a vulnerability in the RDMA/irdma driver was fixed that caused an out-of-bounds read during CQ memory registration. The issue was due to improper setting of the cqmr->split field, leading to an out-of-bounds read for GEN_2 and newer hardware.

In the Linux kernel, a vulnerability in the RDMA/siw driver was fixed that caused a use-after-free when disassociating a socket from an endpoint. The issue occurred during processing of a malformed MPA request, potentially leading to closure of the new endpoint and access to freed memory.

In the Linux kernel BPF mechanism, when freeing bpf_rb_root, the red-black tree node pointers are not cleared. If the object survives the free, it may contain stale pointers to the freed structure, which upon address reuse can lead to incorrect tree removal.

In the Linux kernel kernfs mechanism, there is a race in xattr operations when multiple superblocks with different namespaces share the same kernfs_node. xattr operations are not properly serialized, which can lead to a race in simple_xattr_set().

A vulnerability in the Linux kernel's kernfs subsystem causes a NULL pointer dereference when a new node is created, because the parent and root pointers are not yet initialized when the LSM security hook runs. This leads to a kernel panic, reproducible deterministically on SELinux-enabled systems during the first cgroup mkdir by systemd.

In the Linux kernel wifi driver wcn36xx, there is a heap overflow due to lack of validation of the HAL response length from firmware. A response larger than 4096 bytes can overflow the hal_buf buffer.

In the Linux kernel wifi driver wcn36xx, there is an out-of-bounds read caused by lack of validation of the firmware-controlled count field in the PRINT_REG_INFO message. An overly large count can lead to reading beyond the buffer.

In the Linux kernel ALSA seq, snd_seq_read() copies a variable-length event header to userspace without clearing the data.ext.ptr pointer, which can leak the kernel address of the extension cell.

In the Linux kernel BPF mechanism, there is a lack of rejection of BPF_LSM_CGROUP programs marked as sleepable during load. This can lead to calling sleeping functions in a context where it is not allowed, causing a kernel error.

In the Linux kernel BPF mechanism, there is a deadlock on re-entry from NMI or tracepoint into LRU locks. BPF programs can re-enter a lock already held on the same CPU, causing AA-deadlock.

In the Linux kernel mac80211 mechanism, ieee80211_s1g_check_tim() passes an incorrect end pointer for the PVB walk, which can lead to an out-of-bounds read beyond the TIM element.