CVE Vulnerability Catalog

In the Linux kernel CXL region subsystem, cxl_cancel_auto_attach() used cxled->pos as an index into p->targets[], but it could be a negative errno, causing out-of-bounds access.

In the Linux kernel CXL region subsystem, a vulnerability exists where NULL pointer holes can remain in the target array of an active region after removing endpoint decoders. This leads to NULL pointer dereference (general protection fault) and incorrect counting of attached decoders, potentially causing malfunction. The fix fills the first free target slot during auto-discovery.

In the Linux kernel, the CXL region subsystem now blocks region deletion during region creation. The lock scope was expanded to prevent deletion in the critical period between construction and target attachment, and between device registration and removal action registration. Without this, userspace could confuse the kernel and violate assumptions about region lifetime.

In the Linux kernel, the CXL region subsystem resolves region deletion races. Instead of installing new devres actions per region, the existing root decoder unregistration event is used to remove all remaining regions. An xarray of regions replaces the devres list, addressing three issues: sysfs users racing to delete the same region, multiple actions triggering deletion, and userspace racing devres_release_all().

In the Linux kernel, the power supply core fixes an allocation issue for the supplied_from property. When the dts property power-supplies has multiple values, accessing psy->supplied_from[i-1] in __power_supply_populate_supplied_from can overrun the supplied_from array.

In the Linux kernel, the handshake subsystem now requires admin permission for the DONE command. Previously, DONE had no privilege check, allowing an unprivileged process to send a forged DONE with status 0, causing the kernel to treat the handshake as successful, or with a non-zero status, tearing down a legitimate in-flight handshake.

A vulnerability in the Linux kernel's bnxt driver causes an underflow when building the skb head during XDP head-grow operations. This leads to corrupted page reference counts, potentially causing premature recycling and double-free of memory.

In the Linux kernel, the TCP subsystem clears sock_ops cb flags before force-closing a child socket. A child socket inherits the listener's bpf_sock_ops_cb_flags, and if its setup fails, it may be closed without holding the lock, leading to a warning in tcp_set_state(). The fix clears these flags at a common point to avoid BPF callbacks on an unestablished socket.

In the Linux kernel, the net/sched/sch_codel module has a vulnerability where qdisc_tree_reduce_backlog is called during peek before qlen is restored. This can lead to incorrect deactivation of the parent class, causing a system crash (e.g., wild memory access) when qfq is used with codel as a child.

In the Linux kernel, the net/sched/sch_dualpi2 module has a vulnerability leading to a null-pointer dereference. During peek, when dualpi2 drops packets, it calls qdisc_tree_reduce_backlog before restoring the qlen counter, which can mistakenly deactivate the parent class and cause a system crash.

In the Linux kernel, the net: mana subsystem initializes the gdma queue id to INVALID_QUEUE_ID. Previously, the id remained 0, which could lead to deleting an incorrect queue during cleanup after a failed creation, potentially corrupting gc->cq_table[0] and affecting another queue.

A vulnerability in the Linux kernel's network watchdog code (net/sched/sch_generic.c) involves races in reference tracking. Lack of synchronization between netdev_watchdog_up() and dev_watchdog() can lead to list corruption and system crash.

In the Linux kernel, the t7xx WWAN driver's t7xx_port_ctrl_tx() function clones each skb fragment before passing it to the transmit path. The lack of a check on skb_clone() results in a NULL pointer dereference when cloning fails.

In the Linux kernel, the KCM module's kcm_attach() and kcm_unattach() functions replace callback pointers (sk_data_ready, sk_write_space) on a live TCP socket without using WRITE_ONCE(). This can lead to inconsistent observations of these fields on other CPUs and incorrect callback invocations.

A vulnerability in the Linux kernel's ALSA sequencer subsystem related to FIFO resize operation (snd_seq_fifo_resize) has been identified. The issue involves stale cells remaining in the FIFO during resize, leading to a deadlock in snd_seq_pool_done when deleting the old pool. An attacker can trigger this via ioctl calls, causing a thread to block indefinitely.

In the Linux kernel, the netfilter nf_dup_netdev module's nft_dup and nft_fwd functions have been updated to use the nf_dev_xmit_recursion() helpers. Additionally, bottom halves (BH) are disabled during skb transmission to prevent migration to a different CPU and imbalanced decrementation of recursion counters.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

In the Linux kernel, the BPF mechanism for uprobe_multi data lacked an access_ok check before using __get_user, potentially allowing unauthorized access to user memory. The fix adds proper bounds checking.

A use-after-free vulnerability was found in the Linux kernel's udp_bpf_recvmsg() function for sockmap. The issue stems from missing serialization of access to the sk_msg structure, which can lead to use of freed memory during concurrent reads. The fix restores lock_sock() in this function.

A vulnerability was found in the Linux kernel's BPF sockmap mechanism, involving an integer overflow in the bpf_msg_pop_data() function. The addition of start + len is performed in 32-bit arithmetic, allowing the bounds check to be bypassed and leading to an out-of-bounds access on the scatterlist, resulting in a general protection fault and potential system crash.