CVE Vulnerability Catalog

A vulnerability was found in the Linux kernel's perf subsystem for AMD processors. During SVM (virtualization) toggling on PerfMonV2-capable CPUs, amd_pmu_enable_all() incorrectly enables Branch Sampling (BRS) even when not supported by hardware, leading to a #GP fault and potential system crash.

In the Linux kernel's mvebu GPIO driver, there is a memory leak during unbind because generic chips are not freed by mvebu_gpio_remove_irq_domain().

In the Linux kernel's IPv4 IGMP module, there is a race condition between device teardown and IGMP query processing, which can lead to use-after-free in igmp_gq_start_timer().

In the Linux kernel's IPv6 MLD module, there is a race condition between device teardown and MLD query processing, which can lead to use-after-free in the MLD delayed work.

In the Linux kernel's IPv4 IGMP module, there are potential memory leaks in igmp_mod_timer() and igmp_stop_timer() due to incorrect reference counting, leading to the multicast group structure not being freed.

In the Linux kernel, the netfilter nft_lookup module has a bug in catchall element handling with inverted lookups. The 'found' variable is not recomputed after 'ext' is replaced by the catchall lookup, which can lead to incorrect matching or skipping of the catchall element in negated queries.

In the Linux kernel, the IPVS module has an issue ensuring that inner headers in ICMP errors are in the skb headroom. After stripping outer headers with pskb_pull(), the inner IP headers may not be available for functions like ipv4_update_pmtu(), icmp_send(), and IP_VS_DBG(). Additional length checks for inner headers were added.

In the Linux kernel, the cifs module has a vulnerability due to lack of validation of string offsets in DFS responses. A malicious server can provide offsets pointing outside the response buffer, leading to out-of-bounds memory read during path name processing.

In the Linux kernel SUNRPC subsystem, a use-after-free vulnerability exists in the TLS connect path. Nothing pins the upper rpc_clnt across the delayed connect_worker, which can lead to dereferencing freed memory when a TLS connection fails (e.g., mTLS error).

In the Linux kernel, the dm era module has a bug where metadata_open() returning NULL is not handled properly. The era_ctr() function only checks IS_ERR(md), and since IS_ERR(NULL) returns false, NULL is treated as a valid result, leading to a NULL pointer dereference when accessing metadata.

In the Linux kernel, a vulnerability in the CIFS/SMB client causes a busy dentry warning during unmount after direct I/O (DIO) operations. The issue stems from delayed dentry reference release via workqueues, potentially leading to improper unmount. The fix adds a per-superblock outstanding request counter and waits for it to reach zero before unmounting.

In the Linux kernel, the regulator_lock_two() function compares the error code against -EDEADLOCK instead of -EDEADLK. On MIPS, SPARC, and PowerPC architectures these values differ, causing the code to fall into WARN_ON and return with only one regulator locked when a real deadlock backoff occurs. In practice, the bug only affects MIPS because the regulator core is not built or used on the other platforms.

In the Linux kernel DRM fb-helper, the fbdev output is now synchronized to the vblank of an active CRTC only. Previously, the first CRTC was chosen, causing warnings about vblank wait timeouts when the fbdev output was not on CRTC 0. The fix selects the first active CRTC and supports both atomic and non-atomic drivers.

In the Linux kernel octeontx2-af driver, mbox handling for a VF with promiscuous and all_multi flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs because the APIs that enable/disable these rules operate only on the PF, even when the request comes via a VF interface. The fix adds an is_vf() check in the disable paths to prevent a VF from inadvertently clearing the PF's MCAM rules.

In the Linux kernel drm/xe driver, xe_vm_madvise_ioctl() allocates a VMA array in get_vmas(). On error in the L2 flush validation path for PAT madvise, the array is not freed, leading to a memory leak on each failed ioctl. The fix jumps to free_vmas instead of directly to madv_fini.

In the Linux kernel SMB client, smb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload before copying it to userspace. The addition of OutputOffset and qi.input_buffer_length can wrap in 32-bit arithmetic, allowing a malicious server to bypass the bounds check and read outside the response buffer. The fix uses size_add() for safe addition.

In the Linux kernel trace_remote_alloc_buffer(), if page allocation fails, desc->nr_cpus is not yet incremented for the current CPU, causing a partially allocated rb_desc to not be freed in trace_remote_free_buffer(). The fix increments desc->nr_cpus as soon as the first allocation for the current CPU succeeds.

In the Linux kernel mlxsw driver, mlxsw_sp_port_lag_join() does not release the LAG reference when mlxsw_sp_port_lag_index_get() fails. Other error paths jump to a cleanup label that calls mlxsw_sp_lag_put(), but this path returns an error without releasing. The fix replaces 'return err' with a goto to the cleanup label.

In the Linux kernel mlxsw driver, mlxsw_sp_vrs_lpm_tree_replace() in the error rollback loop does not update the vr pointer, causing the loop to operate on the same VR and not roll back earlier replacements. This leads to a reference leak to new_tree. The fix reinitializes vr inside the loop with the updated index.

In the Linux kernel vduse driver, there is a race between vduse_dev_msg_sync and vduse_dev_read_iter that can lead to a double list_del() crash. The fix ensures that vduse_msg is on send_list or recv_list outside the msg_lock critical section.