CVE Vulnerability Catalog

In the Linux kernel, the lockd service's nlm4svc_lookup_file() function uses uninitialized bytes in file_hash() when the file handle length is less than LOCKD_FH_HASH_SIZE. This causes the same handle to hash to different buckets, leading to lookup failures. The fix zeroes only the tail bytes that file_hash() would otherwise consume.

A vulnerability in the Linux kernel's BPF mechanism related to map value recycling has been discovered. During map update or delete, special fields (e.g., timers, workqueues) were freed in the operation context, which could be unsafe in NMI context. A new cancel function has been introduced that performs only NMI-safe cleanup, leaving full destruction to the final cleanup path.

In the Linux kernel, vduse_dev_open() has a race condition between IDR lookup and acquiring the device lock. An attacker can exploit the window where VDUSE_DESTROY_DEV removes and frees the object before the open path locks it, leading to use-after-free.

In the Linux kernel, vhost_vdpa_mmap() and vhost_vdpa_fault() do not properly validate the virtqueue index before using it in get_vq_notification(). Missing check that the index is less than v->nvqs allows an out-of-range index to reach the driver, potentially leading to out-of-bounds access and system crash.

In the Linux kernel, the virtio:rtc driver does not delete old virtqueues before reinitializing them during device restore. If reinitialization fails, a NULL pointer dereference can occur in vp_del_vq(), crashing the guest kernel.

A vulnerability in the Linux kernel's vhost-net allows zerocopy ubufs to be completed multiple times. Cloning skbs by the network stack (e.g., batman-adv) increments the ubuf_info refcount, but vhost_zerocopy_complete() treats every callback as a completed descriptor, leading to use-after-free.

In the Linux kernel, the vdpa/octeon_ep driver's interrupt handler looks up the IRQ index in oct_hw->irqs instead of assuming irq - irqs[0]. The fix supports non-contiguous IRQ numbers and avoids incorrect ring indexing.

In the Linux kernel, when the data=journal mount option is used, ext4_journalled_write_end() incorrectly calls ext4_write_inline_data_end() without checking the EXT4_STATE_MAY_INLINE_DATA flag. This can trigger a BUG_ON in ext4_write_inline_data(), causing a kernel crash.

A vulnerability was found in the Linux kernel's ext4 filesystem related to the EXT4_IOC_MOVE_EXT operation. The donor file validation was performed too late, after acquiring locks, which could lead to a deadlock when combined with a concurrent filesystem freeze. The fix moves the superblock check before any locking operations.

In the Linux kernel, the vfio/qat driver's qat_vf_resume_write() checks the file position before taking the migf->lock, but copies data after taking the lock and re-reading the position. Two concurrent writers can bypass the bounds check and write past the end of the migration-state buffer.

In the Linux kernel, the BPF cookie compatibility check for program arrays is insufficient. A program without cgroup storage can be considered compatible with any storage cookie, allowing a bridge in a tail call chain between an entry program and a storage-using callee, leading to incorrect access to cgroup local storage.

In the Linux kernel, the Bluetooth hci_qca driver has a NULL pointer dereference in qca_setup() for non-serdev devices. hu->serdev is NULL, and the function unconditionally calls serdev_device_get_drvdata(hu->serdev), causing a crash. The fix adds a NULL check before dereferencing.

In the Linux kernel, the Bluetooth hci_qca driver has a NULL pointer dereference in qca_dmp_hdr() for non-serdev devices. hu->serdev is NULL, and the function unconditionally dereferences hu->serdev->dev.driver->name, causing a crash. The fix adds a NULL check and falls back to "hci_ldisc_qca".

In the Linux kernel, the Bluetooth hci_core subsystem has a use-after-free vulnerability in hci_unregister_dev(). The function does not disable cmd_timer and ncmd_timer before freeing the hci_dev structure. If a timer fires during device teardown, the callback dereferences freed memory, leading to use-after-free. The fix adds disable_delayed_work_sync() calls alongside existing disable_work_sync().

In the Linux kernel, the Bluetooth btmtk driver has a URB leak in the error path of alloc_mtk_intr_urb. When btmtk_isopkt_pad() fails, the previously allocated URB is not freed, leading to memory leak. The fix adds usb_free_urb() before returning the error.

In the Linux kernel, the Bluetooth hci subsystem has a vulnerability due to improper validation of the capability element length in controller responses. hci_read_codec_capabilities() only checks the payload length but does not account for the length byte, allowing out-of-bounds read. The fix validates the full element size including the length byte.

In the Linux kernel, the RDMA/core subsystem has an error in the flow of moving FRMR handles between queues. When moving to a non-empty inactive queue fails due to page allocation failure, the handle is not handled and mkey leaks. The fix introduces push_queue_to_queue_locked() that performs no allocation and simplifies error handling.

In the Linux kernel, the RDMA/core subsystem has an error in the error path when setting FRMR as pinned. When the push to the pool fails, FRMR handles are not destroyed, leading to resource leak. The fix adds destruction of FRMR handles in case of push failure.

In the Linux kernel, the RDMA/mlx5 driver has an undefined shift of user RQ WQE size. set_rq_size() computes the size as "1 << rq_wqe_shift" based on user-provided value, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shift of 31 also overflows a signed integer, leading to undefined behavior. The fix uses check_shl_overflow() to compute the size and rejects invalid values.

In the Linux kernel, the RDMA/mlx5 driver has a bug where it frees the software-provided UAR index instead of the hardware-provided one. The fix is to free the UAR index returned by the hardware.