CVE Vulnerability Catalog

In the Linux kernel's fprobe tracing mechanism, a NULL pointer dereference vulnerability was found in fprobe_fgraph_entry(). During two walks of the fprobe list (one for sizing, one for filling), a new fprobe can become visible, leading to writing past reserved memory and a crash.

In the Linux kernel's irqchip/ts4800 driver, a missing chained handler cleanup on remove was found. After driver removal, a dangling handler remains that may be called when the parent interrupt fires, potentially accessing freed memory and causing a kernel crash.

In the Linux kernel's SCTP subsystem, a race condition was found in sctp_free_addr_wq() regarding the addr_wq_timer. Using timer_delete() does not guarantee that a currently running timer handler has completed, which can lead to use-after-free.

In the Linux kernel's ksmbd server, a vulnerability was found where undersized DACLs are not properly rejected before parsing ACEs. Due to an underflow in the calculation, a malicious client can bypass the ACE count limit and cause excessive memory allocations.

A use-after-free vulnerability was found in the Linux kernel's ksmbd (SMB server) module. The issue is a race between reading fp->owner.name during durable handle owner comparison and freeing it in the reopen path. An attacker could exploit this to gain unauthorized access or cause a system crash.

In the Linux kernel's xen/pvcalls driver, the request ID (req_id) from the backend is not validated before being used as an index into the rsp[] array. A malicious or buggy backend can set req_id out of bounds, leading to an out-of-bounds write. Additionally, the int type for req_id does not cover u32 values, allowing negative indexing.

In the Linux kernel, vfs_tmpfile() does not check whether the caller's fsuid and fsgid map into the filesystem. On an idmapped mount that does not cover the caller, a new temporary file (O_TMPFILE) is created with owner (uid_t)-1, which is incorrect. Other file creation paths already perform this check.

In the Linux kernel, in afs_extract_vl_addrs(), error codes are only set on the first iteration of the loop. Subsequent iterations do not update them, which can lead to incorrect error reporting.

In the Linux kernel's AFS filesystem, the AS_RELEASE_ALWAYS flag is set for symlinks and mountpoints that use afs_dir_aops without a release_folio callback. This causes try_to_free_buffers() to be called with null buffer_heads, leading to a pointer dereference.

In the Linux kernel's AFS filesystem, the net->cells_outstanding counter is incremented before checking for failure of idr_alloc_cyclic(). On error, the counter remains incremented, leading to an incorrect state.

In the Linux kernel's AFS filesystem, initializing the work_struct lock_work only once in the slab init function is insufficient. This causes DEBUG_OBJECTS warnings and potential issues on reuse. The fix requires reinitialization after inode allocation and flush before eviction.

In the Linux kernel's AFS filesystem, callback service message parsers do not pass through -EAGAIN correctly. afs_extract_data() returns -EAGAIN, but it is inadvertently converted to 0, which can lead to incorrect processing.

In the Linux kernel's AFS filesystem, afs_break_some_callbacks() does not check if afs_lookup_volume_rcu() returned NULL (e.g., when the volume is unknown). This could lead to a NULL pointer dereference.

In the Linux kernel's AFS filesystem, there is a lack of locking around modifications of net->cells_dyn_ino. The fix requires taking net->cells_lock exclusively and moving the removal of the cell from net->cells_dyn_ino to afs_destroy_cell_work(), because afs_cell_destroy() runs in RCU cleanup context.

In the Linux kernel's AFS filesystem, afs_insert_volume_into_cell() sets the AFS_VOLUME_RM_TREE flag on the new volume instead of the replaced one. This causes the old volume to be removed from the tree twice and the new volume never to be removed.

In the Linux kernel iomap code, during atomic direct I/O, when bio_iov_iter_get_pages() or the bounce helper builds a short bio, the REQ_ATOMIC size check rejects it before submission. The old error path only dropped the bio reference, leaving pages attached to the bio unreleased. The fix releases or unbounces the pages before falling through to out_put_bio.

In the Linux kernel Minix filesystem, minix_check_superblock() uses minix_blocks_needed() to verify bitmap block counts. The calculation uses unsigned int arithmetic, which can overflow when s_ninodes or s_zones is near UINT_MAX. This leads to accepting a zero bitmap block count, and then minix_fill_super() dereferences s_imap[0] or s_zmap[0], causing a kernel panic.

In the Linux kernel cachefiles module, the nomem_d_alloc error path in cachefiles_get_directory() has a double unlock. When start_creating() fails with -ENOMEM, it already releases the parent directory lock, but the error path calls inode_unlock() again, corrupting the rwsem state.

In the Linux kernel iomap code, when trimming io_size to EOF, an underflow can occur if end_pos is below ioend->io_offset. This causes io_size to wrap to a huge value, potentially leading to errors in write handling and data corruption.

In the Linux kernel netfs module, netfs_create_write_req() skips caching if the fscache cookie is disabled, but this is problematic because async cache object creation might not have completed. The fix removes the cookie checks and delegates this to fscache_begin_write_operation().