CVE Vulnerability Catalog

In the Linux kernel GPU buddy subsystem, an alignment issue was found in the try_harder function. When a candidate was not aligned to min_block_size, the returned range could have an incorrect offset. The fix aligns candidates down to min_block_size instead of rejecting the request, ensuring correct operation.

In the Linux kernel SELinux module, connect-related permissions were not checked when using TCP Fast Open. The fix adds a call to selinux_socket_connect() in the socket_sendmsg() hook when MSG_FASTOPEN is used.

In the Linux kernel SELinux module, selinux_sctp_bind_connect() dereferenced sk->sk_socket, which could cause issues when the hook was invoked from the ASCONF softirq path. The fix refactors the code to use struct sock * directly and avoid sk_socket dereference.

In the Linux kernel uleds driver, a potential buffer overread was found due to lack of guaranteed null-termination of the name string from userspace. The fix uses strnchr() and checks proper string termination.

In the Linux kernel sm501 driver, a reference leak was found on failed device registration. The fix adds a call to platform_device_put() before returning the error.

In the Linux kernel x86/virt/sev subsystem, a previous fix regarding WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN was reverted. The call to wbinvd_on_all_cpus() before SNP_INIT_EX was restored to meet SNP specification requirements for clean cache lines.

In the Linux kernel x86 boot code, an issue was found with validation of the console=uart8250 parameter, where an invalid baud rate could cause a system hang during early boot due to division by zero. The fix adds a fallback to DEFAULT_BAUD when the rate is 0.

In the Linux kernel perf/x86/amd/brs subsystem, a kernel address leak to user space was found. Despite requesting PERF_SAMPLE_BRANCH_USER, branch records may contain kernel addresses. The fix extends the software filter to drop records with kernel branch-from addresses.

In the Linux kernel s390/perf_cpum_cf subsystem, a speculation barrier (array_index_nospec) was missing when using the ev variable as an array index. The fix adds a call to array_index_nospec() to prevent speculative execution.

In the Linux kernel batman-adv, a use-after-free issue was found due to potential buffer reallocation by pskb_may_pull() in batadv_interface_rx(). The fix reassigns the ethernet header pointer after reallocation.

In the Linux kernel's batman-adv module, after pskb_may_pull() is called by batadv_get_vid(), the skb buffer may be reallocated. The unicast_packet pointer was not reassigned after this reallocation, potentially leading to a use-after-free.

In the Linux kernel's batman-adv module, after pskb_may_pull() is called by batadv_bla_is_backbone_gw(), the skb buffer may be reallocated. The gateway address pointer was not reassigned after this reallocation, potentially leading to a use-after-free.

In the Linux kernel's batman-adv module, the function batadv_interface_tx() assumes that at least ETH_HLEN bytes are available but does not check this itself. A local user with eBPF TC hook access can truncate the packet and redirect it to a batadv interface, potentially leading to an out-of-bounds read.

In the Linux kernel's batman-adv module, the function batadv_send_tt_request() checks for 'ret == true' instead of 'ret == false' after a failed send buffer allocation. This causes the TT request information not to be cleaned up, potentially leading to request storms.

In the Linux kernel's batman-adv module, the function batadv_frag_send_packet() does not properly handle errors during pre-checks for empty payload or zero fragment size. In such cases, the skb is not freed, leading to memory leaks.

In the Linux kernel's batman-adv module, during mesh interface registration, if another receiver of the NETDEV_REGISTER notification vetoes the registration, the batadv_meshif_vlan object is not cleaned up because .dellink is not called. This leads to a memory leak.

In the Linux kernel's batman-adv module, during fragmentation, if linearization of an skb with a frag_list fails, the reference to primary_if is not released, leading to a reference leak.

In the Linux kernel's batman-adv module, when checking data availability for the num_dests field in struct batadv_tvlv_mcast_tracker, offsetof() is used instead of offsetofend(), which always returns 0. This causes the check to always pass, even when only 0 or 1 bytes are available, leading to an out-of-bounds read.

In the Linux kernel's batman-adv module, the number of VLANs in a TT unicast TVLV is of type u16 and is multiplied by the size of struct batadv_tvlv_tt_vlan_data (8 bytes). This can overflow the u16, invalidating all additional safety checks and potentially leading to an out-of-bounds read.

In the Linux kernel's jbd2 module, the function jbd2_journal_initialize_fast_commit() validates journal capacity, but due to an integer underflow on unsigned numbers, the check can be bypassed. This leads to corruption of j_last, j_fc_first, and j_free, resulting in journal abort.