CVE Vulnerability Catalog

In the Linux kernel's NTFS3 filesystem (fs/ntfs3), during log replay (log_replay) in the analysis pass, the copy_lcns function did not verify that write indices into the page_lcns[] array stay within bounds. A specially crafted log record (LRH) could cause an out-of-bounds write (slab-out-of-bounds), leading to memory corruption.

In the Linux kernel's NTFS3 filesystem, the UpdateResidentValue function did not validate the attribute offset, potentially leading to data size underflow and out-of-bounds read. The fix adds validation at the source.

In the Linux kernel's NTFS3 filesystem, the indx_find_buffer function had no recursion depth limit, potentially leading to kernel stack overflow. The fix adds a depth parameter and a check against the limit.

A vulnerability in the Linux kernel's ntfs3 driver allows an infinite loop during mount of a crafted NTFS disk image, hanging the mounting thread and triggering a soft-lockup panic. The issue is caused by an unbounded iteration in check_rstbl() while traversing the free-entry list of RESTART_TABLE. A crafted image with a cyclic free chain bypasses existing guards and causes a denial of service.

In the Linux kernel's NTFS3 filesystem, a vulnerability allows an out-of-bounds write when promoting a full resident $INDEX_ROOT to $INDEX_ALLOCATION. A crafted NTFS image can cause memcpy of attacker-controlled data past the allocated buffer, leading to heap corruption.

In the Linux kernel's NTFS3 filesystem, a vulnerability allows out-of-bounds write due to missing validation of the split-point offset in indx_insert_into_buffer. A crafted NTFS image causes an integer underflow and a near-4GiB memmove, corrupting memory and panicking the kernel.

In the Linux kernel's NTFS filesystem, the ntfs_rename function could cause a deadlock due to incorrect locking order of mrec_lock. The fix changes the locking order to avoid deadlock.

In the Linux kernel's NTFS filesystem, attribute list update during superblock teardown could cause a self-deadlock. The fix adds a check for superblock activity and returns an error if inactive.

In the Linux kernel's NTFS filesystem, ntfs_lookup_inode_by_name() returns MFT references read from directory index entries on disk, which are untrusted. The function can return an error-marked MFT reference without validation, causing callers to misinterpret the result. The fix normalizes all such references to ERR_MREF(-EIO) across all four return paths.

In the Linux kernel's NTFS filesystem, there is a self-deadlock issue during inode eviction. An attribute-list update can drop the last reference to a temporary attribute inode, leading to ntfs_drop_big_inode() being called for the base inode from within its own writeback path. If the base inode is unlinked, the function waits for folio writeback that the same worker is responsible for, causing an indefinite wait.

In the Linux kernel's NTFS filesystem, system files such as $Bitmap can be written from userspace, leading to volume corruption and writeback deadlock. The fix marks base metadata files as immutable during inode read so the VFS rejects write, mmap, truncate, and unlink with -EPERM.

In the Linux kernel's NTFS filesystem, ntfs_map_runlist_nolock() can encounter a resident attribute where a non-resident one is expected, previously triggering only a WARN_ON and leading to reading the wrong union member. The fix replaces the WARN_ON with an -EIO error return, causing crafted images to be rejected during mount.

In the Linux kernel's NTFS filesystem, ntfs_non_resident_attr_insert_range() allocates memory for hole_rl before mapping the whole runlist. If mapping fails, the error path returns without freeing hole_rl, causing a memory leak. The fix adds freeing hole_rl before returning from that error path.

A vulnerability in the Linux kernel's Landlock mechanism allows bypassing the LANDLOCK_SCOPE_SIGNAL restriction via the asynchronous SIGIO delivery path. A sandboxed process can send a signal (e.g., SIGKILL) to an entire process group, including processes outside its domain that were meant to be protected. The issue stems from incorrect domain recording for process-group targets.

In the Linux kernel's power supply subsystem (charger-manager), is_full_charged() calls power_supply_get_by_name() and if the voltage condition is met, returns true without releasing the reference, causing a refcount leak. The fix sets a flag and jumps to the out label where the reference is properly released.

In the Linux kernel for MIPS architecture, there is a critical memory management flaw in the scheduler. When CONFIG_CPUMASK_OFFSTACK is enabled, cpumask_var_t is a pointer, so sizeof(new_mask) evaluates to pointer size, causing copy_from_user() to clobber the mask pointer. Additionally, copying occurs before mask allocation. The fix allocates the mask first and uses cpumask_size() to handle variable-sized masks.

In the Linux kernel's mm/huge_memory subsystem, change_non_present_huge_pmd() rewrites a writable device-private PMD swap entry without carrying pmd_swp_uffd_wp. The fix adds carrying this bit to preserve the UFFD_WP marking, similar to change_softleaf_pte() and copy_huge_pmd().

In the Linux kernel for RISC-V architecture, there is a node reference leak in populate_cache_leaves. The while loop drops the reference to prev in each iteration, but if the loop terminates naturally with np == NULL, the last valid node in prev is not released. The fix changes the final of_node_put(np) to of_node_put(prev).

In the Linux kernel, a vulnerability was found in the DAMON subsystem where unsuccessfully committed target PIDs are not properly released, leading to a memory leak. The issue occurs when the commit operation fails after partially copying PIDs and the destination context lacks the appropriate cleanup callback.

In the Linux kernel, a bug was found in mm/damon/sysfs-schemes in the access_pattern_add_dirs() function, where error paths release directory references in the wrong order. This can lead to uninitialized memory dereference or memory leak. The issue has been fixed.