CVE Vulnerability Catalog

In the Linux kernel netfs module, writethrough writes did not set the NETFS_RREQ_OFFLOAD_COLLECTION flag on the request, causing collection to be processed only at the end, and asynchronous O_SYNC writes might not be collected at all. The fix sets this flag.

In the Linux kernel netfs module, error handling in the writeback_iter() loop is incorrect. If an error occurs, writeback_iter() needs to be called again with the error set to clean up iteration state, and the current folio needs unlocking and redirtying.

In the Linux kernel netfs module, during writeback iteration, when ENOMEM occurs, the state of the current folio is incorrect. The folio needs to be redirtied and unlocked before the terminal writeback_iter() is invoked.

In the Linux kernel DRM xe driver, xe_pt_zap_ptes_entry() calls container_of(*child) before checking if the child pointer is NULL, leading to a NULL pointer dereference and crash. The fix moves the container_of() call after a NULL guard, so the function returns early instead of proceeding with an invalid pointer.

In the Linux kernel DRM xe driver, the error path in hw_engine_init() has a double-free of a managed BO. The BO allocated with xe_managed_bo_create_pin_map() has a devm cleanup action registered, and the explicit xe_bo_unpin_map_no_vm() causes a double-free during devm unwind. The fix removes the explicit free.

In the Linux kernel, the drm/xe/pf driver was found to process FAST_REQ or EVENT messages, which can break the VF/PF ABI protocol and trigger an assert on the PF side. The fix prevents the PF from handling these message types.

In the Linux kernel, the drm/xe driver has a NULL pointer dereference vulnerability in bo_meminfo(). When a buffer object is purged, its ttm.resource is set to NULL, but the BO remains in the client's list. Querying memory stats during this time leads to a NULL dereference.

In the Linux kernel, the drm/xe/pt driver has an issue with invalid cursor access for purged BOs. Functions xe_pt_hugepte_possible() and xe_pt_scan_64K() did not check if the BO was purged, leading to warnings and potential misbehavior.

In the Linux kernel, the uprobes mechanism for x86 has a bug where the wrong mm_struct is used in __in_uprobe_trampoline. In the unregister path, current->mm is used instead of the traced process's mm_struct, which is incorrect in the tracer context.

In the Linux kernel, the cifs module has a missing credit release in the failure path of cifs_issue_read(). This can lead to overwriting the credits value when retrying the subrequest, disrupting resource management.

In the Linux kernel, the netfs module has a barriering issue when walking the subrequest list during retry. There is a possibility of seeing a subrequest that was just added by the application thread.

In the Linux kernel, a use-after-free vulnerability was found in the NTFS filesystem's $MFT writeback path. The issue arises from dereferencing a runlist element pointer after releasing the lock, while concurrent $MFT allocation extension can free the underlying memory. This can lead to system crashes or potential code execution.

In the Linux kernel's NTFS filesystem, a use-after-free vulnerability was found in ntfs_attr_fallocate(). The issue arises from dereferencing a runlist element pointer after releasing the lock, which can lead to accessing freed memory. An attacker could exploit this flaw to cause a system crash or potentially escalate privileges.

In the Linux kernel, the HID-BPF module has a vulnerability in hid_bpf_get_data() due to an incorrect range check. Because of unsigned arithmetic, a very large size can wrap the sum and bypass the check, allowing a pointer outside the buffer to be returned.

In the Linux kernel, the GUE module has a vulnerability due to missing validation of the REMCSUM private option length. guehdr_priv_flags_len() returns 0 even when GUE_PFLAG_REMCSUM is set, allowing malformed packets to pass and read missing fields from subsequent bytes.

In the Linux kernel, the netfilter xt_u32 module lacks validation of shift counts supplied by rules. A malformed rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during packet evaluation. Validation of XT_U32_LEFTSH and XT_U32_RIGHTSH operands was added in u32_mt_checkentry() to reject malformed rules before they reach the packet path.

In the Linux kernel, the netfilter xt_rateest module has a truncation issue in xt_rateest_mt() where values are truncated to 32 bits. On links faster than ~34 Gbps, where byte rate may exceed 2^32-1, the comparison becomes incorrect. The fix changes local variables to u64.

In the Linux kernel, the netfilter ip6tables module mishandles malformed IPv6 extension headers. For ah, hbh, and rt matches, the advertised header length checks are missing or outdated. The fix adds the missing check for ah and updates checks for hbh and rt, also setting hotdrop to true to drop malformed packets.

In the Linux kernel, the netfilter xt_connmark module (revision 2) lacks validation of shift parameters. A shift_bits value of 32 or more triggers an undefined shift, and invalid shift_dir values are accepted and silently fall back to left shift. The fix rejects invalid parameters in connmark_tg_check() so errors are caught at rule installation time.

In the Linux kernel, the platform/x86: bitland-mifs-wmi driver has a NULL pointer dereference during suspend/resume. The driver registers two WMI devices: control and event. During probe, the event device path returns early, leaving data->pp_dev as NULL. PM operations are triggered for both devices, leading to NULL dereference in bitland_mifs_wmi_suspend(). The fix adds a validity check for data->pp_dev in suspend and resume callbacks.