CVE Vulnerability Catalog

In the Linux kernel, a bug was found in mm/damon/sysfs-schemes in the damon_sysfs_scheme_add_dirs() function, where the error path releases the tried_regions directory instead of the stats directory after a failed setup. This leads to a leak of the stats directory object and potential uninitialized memory dereference.

A vulnerability was found in the Linux kernel in the make_uffd_wp_huge_pte() function in fs/proc/task_mmu. The function did not use huge_ptep_modify_prot_start() before modifying a HugeTLB PTE, causing a race condition and loss of hardware Dirty/Accessed bit updates. The fix adds the missing call to ensure PTE consistency.

A vulnerability in the Linux kernel causes a self-deadlock in the PAGEMAP_SCAN mechanism for hugetlb mappings. An ioctl request with PM_SCAN_WP_MATCHING on a hugetlb VMA with unpopulated pages hangs the calling thread unkillably. The issue arises from attempting to re-acquire the same VMA lock (read->write) while handling holes in the range.

In the Linux kernel, a stale warning was found in fs/proc/task_mmu in the pagemap_pmd_range_thp() function, which triggered when a PMD entry was not a migration entry. After device-private entries at the PMD level were added, the warning became false. The warning has been removed.

In the Linux kernel, a bug was found in mm/mm_init regarding uninitialized struct pages for ZONE_DEVICE. When DAX memory is hotplugged into an unoccupied subsection of an early section, section_activate() reuses the unoptimized boot memmap, but compound_nr_pages() still assumes optimization and initializes only a reduced number of pages. The remaining pages are left uninitialized, which can lead to unexpected behavior or crashes.

In the Linux kernel, a bug was found in the mtd: slram module in the register_device() function, where an entry is linked to the global list before all required state is allocated. If a later allocation, memremap(), or mtd_device_register() fails, the partially initialized entry remains on the list, which can lead to dereference or free of invalid state during later cleanup.

In the Linux kernel, a bug was found in the 9p module in the v9fs_dec_count() function, which unconditionally calls drop_nlink() on regular files even when nlink is already zero. In cacheless mode, the client refetches metadata from the server, leading to a race and WARN_ON warning. The fix skips nlink update in cacheless mode.

In the Linux kernel, a bug was found in the kho module where the scratch size is not always aligned to CMA_MIN_ALIGNMENT_BYTES. When using fixed sizes from the command line, an unaligned size can lead to releasing a pageblock that is only partially scratch. The fix rounds up the size in both cases.

In the Linux kernel, the vmu-flash driver for MTD memory has a bug causing access to uninitialized data when allocating memcard structs. The fix uses kzalloc instead of kmalloc to zero the memory before use.

In the Linux kernel, the pl353 driver for rawnand memory has a resource allocation issue during probe. devm_ioremap is called with the parent device instead of the current one, causing the register area not to be released when the module is unloaded.

In the Linux kernel, a vulnerability in net/9p causes an infinite loop in p9_client_rpc when handling a fatal signal (e.g., SIGKILL). The issue occurs when a P9_TFLUSH call is made on a transport without a peer (e.g., fd transport via pipes with no 9p server), and a fatal signal interrupts the wait. The bug clears the TIF_SIGPENDING flag before rechecking, leading to re-sleeping and system hang.

In the Linux kernel, the rawnand driver has a bug in the condition in the 'nand_select_target()' function. The condition does not correctly check the range of the 'cs' value, which should be in [0:nanddev_ntargets[.

In the Linux kernel, the OCFS2 filesystem has a bug in ocfs2_move_extent that can cause moving data to occupied clusters. During block group scanning, if no free run is found, phys_cpos remains unchanged, potentially leading to overwriting data belonging to another inode.

In the Linux kernel, the OCFS2 filesystem has a bug in ocfs2_assure_trans_credits that can lead to a NULL pointer dereference when the journal aborts during DIO operations. The function does not check if the transaction handle is aborted before reading remaining credits.

In the Linux kernel, the OCFS2 filesystem has a bug in ocfs2_sum_rightmost_rec that can lead to an array-index-out-of-bounds (UBSAN) when on-disk data is corrupted. The function does not validate l_next_free_rec before using it to index the l_recs array.

In the Linux kernel, the OCFS2 filesystem has a bug in ocfs2_checkpoint_inode that can lead to a NULL pointer dereference during unmount. After the journal is freed and osb->journal is set to NULL, the function tries to use it.

In the Linux kernel, a vulnerability in the OCFS2 filesystem allows acceptance of invalid i_mode values in dinodes. Lack of POSIX file type validation can lead to processing of forged metadata, resulting in incorrect system behavior. The patch adds structural checks rejecting dinodes with non-canonical i_mode types.

In the Linux kernel, the OCFS2 filesystem has an issue with accepting non-inline dinodes with non-zero size and zero clusters. Such structures are malformed but are not rejected in some paths, which can lead to errors during file or directory operations.

In the Linux kernel, the dfh_get_param_size() function lacks bounds checking after size increment, potentially returning a size larger than the feature region. A malicious FPGA device can exploit this to call memcpy_fromio() with a size exceeding the mapped area.

In the Linux kernel, the thunderbolt network driver (tbnet) lacks a bound on frame_count to the maximum number of skb fragments, leading to out-of-bounds write past frags[] and memory corruption. A malicious peer can send a packet with many small frames to trigger the overflow.