CVE Vulnerability Catalog

In the Linux kernel's nvdimm/btt subsystem, arenas allocated by discover_arenas() or create_arenas() are not freed on some error paths in btt_init(). This leaks memory when BTT initialization fails. The fix calls free_arenas() from the affected error paths.

In the Linux kernel's nvdimm/btt subsystem, memory allocated by btt_freelist_init(), btt_rtt_init(), and btt_maplocks_init() is not freed on some discover_arenas() error paths. This leaks memory when arena discovery fails. The fix adds missing kfree() calls before returning an error.

In the Linux kernel's SUNRPC subsystem, a use-after-free vulnerability exists in the asynchronous TLS handshake handling. The svc_xprt pointer is stored without taking a reference, leading to a race where the callback can write to freed memory. The issue affects NFS servers with TLS enabled when connection close overlaps with the tlshd downcall delivery window.

In the Linux kernel, a race condition in the sunrpc module during TLS handshake cancellation was fixed. When wait_for_completion_interruptible_timeout() returns timeout or signal and cancellation loses the race, the handshake callback may not have committed its side effects, leading to double invocation of the handshake or connection teardown despite successful handshake. The fix waits for the callback to commit before checking flags.

In the Linux kernel's sunrpc subsystem, svc_release_rqst() executes the callback in rqstp->rq_procinfo->pc_release. If a worker thread hits an early error path before a valid rq_procinfo is installed, a stale release hook can be re-triggered against reused state from the previous RPC, leading to double-free or use-after-free. The fix hardens the rq_procinfo lifecycle by clearing it after pc_release, at request entry in svc_process(), and in svc_process_bc().

In the Linux kernel's lockd subsystem, when nlm_do_fopen() fails, the newly allocated nlm_file object is not freed because the error path goes to out_unlock instead of out_free. A client can repeatedly trigger nlm_do_fopen() failures, causing memory leaks. The fix routes the failure through out_free to call kfree().

In the Linux kernel's lockd module, there is an nlm_file refcount leak when the cached nlm_do_fopen() call fails. The cached path in nlm_lookup_file() always reaches the 'found' label even on error, leading to an unreleased reference and preventing proper file cleanup.

In the Linux kernel's SUNRPC module, xdr_buf_to_bvec() writes to the caller's array before checking if the slot is in range, potentially causing an out-of-bounds write. The rq_bvec array passed by nfsd_vfs_write() is allocated without slack, so the OOB store can corrupt adjacent memory.

In the Linux kernel's remoteproc module for Qualcomm platforms, there is a memory leak when adding custom dump segments fails. The allocated minidump_region 'name' is not freed if the operation fails before adding the region to the list.

In the Linux kernel for MIPS DEC, in 64-bit configurations, calling the firmware entry point prom_printf() from a kernel thread other than the initial one can use a stack pointer in the XKPHYS 64-bit segment. This causes incorrect behavior of 32-bit ALU operations in firmware code, leading to a system hang. Only the prom_printf() entry point is affected; other entry points are safe.

In the Linux kernel's cpcap-battery driver, a missing nvmem_device_put() call causes a permanent reference leak to the nvmem device. The leak occurs on success and read-failure paths in cpcap_battery_detect_battery_type().

In the Linux kernel's hugetlb module, there is a mismatch between rsvd charge and uncharge in hugetlb cgroup. A single h_cg pointer is overwritten, leading to the wrong cgroup being used during uncharge, causing a page_counter underflow.

In the Linux kernel's memory_hotplug module, there is a bug where NULL is passed instead of altmap in the error path. When arch_add_memory() succeeds and create_memory_block_devices() fails, arch_remove_memory() is called with NULL altmap, leading to memory corruption.

In the Linux kernel's ntfs module, there is an ordering issue when growing the index root value. The larger header is published before resizing the resident value, which can lead to a transient state considered corrupt if the resize fails.

In the Linux kernel's ntfs module, there is an off-by-one error in bounds checks during mapping pairs decompression. Strict greater-than comparisons allow a one-byte out-of-bounds read when data ends exactly at the boundary.

A vulnerability in the Linux kernel's NTFS filesystem was found where ntfs_attr_find() and ntfs_external_attr_find() do not properly validate length fields in variable-length resident attributes. A crafted disk image can trigger an out-of-bounds read (slab-out-of-bounds) during filename lookup operations.

In the Linux kernel, a bounds check was added before accessing EA entries in the NTFS filesystem. In ntfs_ea_lookup and ntfs_listxattr, it verifies that there is enough space in the EA entry before accessing the next_entry_offset field.

In the Linux kernel, the NTFS filesystem no longer converts zero-length $DATA attributes to non-resident. Previously, when a resident attribute could not be grown in place, other resident attributes were converted to non-resident, but now zero-length $DATA attributes are skipped because fsck treats such non-resident attributes as corruption.

In the Linux kernel, the NTFS filesystem now performs stricter validation of the index block header. The ntfs_index_block_inconsisent() function was modified to validate INDEX_HEADER geometry in INDX blocks more thoroughly, and ntfs_lookup_inode_by_name() uses this function to validate INDX blocks.

In the Linux kernel, a memory leak was found in the NTFS filesystem during failed mount operations. The ntfs_fill_super() function did not release all volume-related resources, such as the NLS map, volume label, and empty bits page, leading to memory accumulation on each failed mount attempt.