CVE Vulnerability Catalog

In the Linux kernel, the sof_ipc4_bytes_put() function has a TOCTOU vulnerability where the copy size is derived from the old buffer instead of the new data. This can lead to truncation of valid data or copying stale bytes.

In the Linux kernel, there is a missing validation of the MODULE_NOTIFICATION payload size before reading bytes/channel data in control update handling.

In the Linux kernel, the sof_ipc3_control_update() function calculates expected_size using firmware-provided num_elems, which can overflow on 32-bit platforms. This could allow size comparison to pass with mismatched sizes, potentially leading to out-of-bounds access.

In the Linux kernel, the sof_ipc3_bytes_put() and sof_ipc3_bytes_get() functions have TOCTOU vulnerabilities and incorrect bounds checking. In bytes_put, the copy size is derived from the old buffer, and in bytes_get, the flex array offset is not accounted for.

In the Linux kernel, the sof_parse_token_sets() function lacks validation of the vendor array size before reading it. A malformed topology with a truncated trailing array can cause out-of-bounds read. Additionally, comparison with negative size can pass due to unsigned promotion.

In the Linux kernel TIPC subsystem, a vulnerability was found where the tracepoint in tipc_sk_enqueue() dumped the sk_receive_queue without proper locking, leading to a use-after-free condition reported by KASAN. The fix restricts the dump to the spinlock-protected backlog queue only.

In the Linux kernel, the qrtr_endpoint_post() function has a 32-bit integer overflow in the ALIGN(size, 4) calculation, which can lead to out-of-bounds write and kernel oops on 32-bit platforms.

In the Linux kernel, the check_tp() function does not reject ATM traffic classes above ATM_ANYCLASS, which can lead to out-of-bounds read when reading /proc/net/atm/pvc.

In the Linux kernel, the ife_decode() function does not guarantee that the inner Ethernet header is accessible in the linear data area, which can lead to a crash with malformed IFE frames.

In the Linux kernel for LoongArch, KVM lacks validation of the irqchip index in irqfd routing, which can lead to out-of-bounds access past the routing table's chip array.

In the Linux kernel for LoongArch, the kvm_vcpu_ioctl_interrupt() function did not validate the IRQ number passed from userspace. Validation has been added to prevent potential issues.

In the Linux kernel for KVM on s390, the _gaccess_shadow_fault() function was missing a radix_tree_preload() call, which could prevent forward progress. The missing call was added and the function was split to simplify locking.

In the Linux kernel for KVM on s390, kvm_s390_get_cmma_bits() used vmalloc() for its output buffer, which does not zero the pages. Under certain conditions, uninitialized bytes could be copied to user space, disclosing stale kernel memory. The fix changes the allocation to vzalloc() to zero the buffer.

In the Linux kernel for KVM on s390, try_get_locked_pte() had an unlikely race that could occur if puds or pmds were unmapped between p?dp_get() and p?d_offset(). The fix eliminates this race.

In the Linux kernel for KVM on s390, kvm_s390_gisc_register() had a GISC refcount leak on AIF enable failure. After registering GISC, if later steps failed, kvm_s390_gisc_unregister() was not called. The fix adds the missing call in the error unwind path.

In the Linux kernel for KVM on arm64, vgic_prune_ap_list() had an issue during interrupt migration to another vCPU. After reacquiring locks, it only checked affinity, not whether the interrupt still belonged to this vCPU. The fix adds a check irq->vcpu == vcpu before moving.

In the Linux kernel for KVM on arm64, vgic_prune_ap_list() had a race between interrupt affinity change and LPI disabling, which could lead to use-after-free (UAF). The fix takes a reference on the interrupt before dropping locks and does not attempt to migrate the pending bit.

In the Linux kernel for KVM nVMX, the consistency check for vTPR vs. TPR threshold was moved into normal controls checks. Previously, the check was done late, which could lead to running L1 with an incorrect CR3. The fix simplifies vTPR access and skips the check in some cases.

In the Linux kernel for KVM SEV, intra-host migration/mirroring of SNP VMs has been disallowed because the feature is not fully implemented. Proper migration requires additional SNP-specific state to be transferred. The fix rejects SNP source VMs in migration/mirroring.

In the Linux kernel for KVM TDX, concurrent change to CPUID entry count during initialization is now rejected. Previously, a user could change cpuid.nent between read and copy, potentially leading to out-of-bounds access. The fix requires the copied count to match the value used for allocation.