CVE Vulnerability Catalog

In the Linux kernel, the xfrm_interface module lacks a CAP_NET_ADMIN requirement in the interface's network namespace during changelink operations. A caller privileged only in one namespace can modify an interface in another namespace, breaking isolation.

A vulnerability was discovered in the Linux kernel TPM character device drivers. Due to FMODE_PREAD and FMODE_PWRITE flags being left enabled, positional read/write operations (pread/pwrite) could lead to out-of-bounds heap reads and out-of-bounds zero writes. The issue is fixed by calling nonseekable_open(), which causes positional operations to fail with -ESPIPE.

A vulnerability in the Linux kernel's SPI driver for i.MX devices (spi-imx) was found. When DMA is selected but the DMA descriptor cannot be prepared, the driver falls back to PIO without undoing DMA configuration, leading to corrupted data transfers. This affects e.g. i.MX8MP boards with Infineon SLB9670 TPM, where data is shifted and the device fails.

In the Linux kernel, the spi-uniphier driver has an initialization order issue: devm_request_irq() is called before initializing the completion used by the interrupt handler. This can lead to calling complete() on an uninitialized completion, causing undefined behavior (observed with KASAN).

In the Linux kernel, the NFS module has an issue with charging unstable writes: nfs_folio_mark_unstable() and nfs_folio_clear_commit() charge NR_WRITEBACK/WB_WRITEBACK by folio size, not request size. When a folio is split into multiple requests, each request charges the whole folio size, inflating counters and potentially forcing hard throttling for all writers.

In the Linux kernel, the nvme-apple driver on Apple A11 has an issue with command tags: tags of pending commands must be unique across admin and IO queues, otherwise the firmware crashes with "duplicate tag error". The workaround for M1 is missing for A11.

In the Linux kernel, the nvmet-auth module has a heap out-of-bounds write vulnerability in nvmet_execute_auth_receive(). The function trusts the AUTH_RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In SUCCESS1 and FAILURE1 states, a short buffer can lead to writing past the allocated memory.

In the Linux kernel, the nvmet-rdma module has an issue with handling inline data with a nonzero offset. The function nvmet_rdma_use_inline_sg() maps the host-controlled offset but assumes the data begins in the first inline page. For offsets larger than the page size, a length underflow can occur, leading to out-of-bounds reads.

In the Linux kernel, the nvmet_sq_create() function has a reference leak. It takes a reference on the ctrl structure, but on error from nvmet_check_sqid() it returns without releasing the reference. The fix jumps to the 'ctrl_put' label to properly release it.

In the Linux kernel, netdev_nl_napi_fill_one() reports the NAPI thread PID in the initial PID namespace instead of the caller's namespace. Since NETDEV_CMD_NAPI_GET lacks admin permission and is netnsok, a caller in a child PID namespace sees the global PID, which should be 0. The fix translates the PID through the caller's namespace.

In the Linux kernel, the CAN ISO-TP module has an RCU synchronization issue in isotp_release(). When NETDEV_UNREGISTER runs first, the function skips synchronization, potentially cancelling a timer while isotp_rcv() is still executing and about to re-arm it, leading to a use-after-free. The fix makes isotp_release() always call synchronize_rcu() before cancelling timers.

A use-after-free vulnerability was found in the Linux kernel's CAN ISO-TP module (can/isotp). The issue occurs during concurrent network device unregistration (NETDEV_UNREGISTER) and socket release (isotp_release), potentially leading to use of freed memory.

In the Linux kernel, a vulnerability in the CAN ISO-TP subsystem was fixed regarding unsynchronized TX state machine transitions. Different contexts (sendmsg, RX path, timers) could act on stale state, corrupting unrelated transfers. The fix serializes the full TX claim lifecycle under so->rx_lock.

A use-after-free (UAF) vulnerability was found in the Linux kernel's CAN BCM (Broadcast Manager) module, specifically in the hrtimer. The issue stems from a missing RX_NO_AUTOTIMER flag check in the packet RX fast-path, allowing the timer to be re-armed after call_rcu() has scheduled memory deallocation. The fix defers timer cancellation and memory freeing to a dedicated workqueue and holds a socket reference until the deferred work completes.

In the Linux kernel, the CAN BCM module has a race condition between lockless reads of bo->ifindex and bo->bound and their locked modifications. This can cause a socket bound to a specific CAN interface to also match 'any' interface. Additionally, bcm_rx_setup() may silently return success when the device disappears concurrently instead of reporting -ENODEV.

A vulnerability in the Linux kernel's CAN BCM (Broadcast Manager) module was found, caused by missing synchronization when updating timer and filter values. Concurrent access from CAN traffic handling threads can lead to a race condition, resulting in incorrect behavior or potential privilege escalation.

In the Linux kernel, the CAN BCM module lacks proper RCU list operations. bcm_rx_setup() and bcm_tx_setup() do not use list_add_rcu(), which can lead to improper initialization of the bcm_op structure during traversal by bcm_proc_show(). Also, bcm_release() removes operations without list_del_rcu(), potentially causing synchronization issues.

In the Linux kernel, the CAN BCM module extends the use of bcm_tx_lock for data and timer updates. New frame data is first validated in a separate buffer and then copied under the lock, preventing observation of partially updated frames. Error handling for memcpy_from_msg() was added, and timer updates were moved under the lock, eliminating torn 64-bit reads on 32-bit platforms.

A data race was detected in the Linux kernel's CAN BCM (Broadcast Manager) module when CAN frames are processed concurrently on different CPUs. The issue affects RX/TX statistics updates, potentially leading to inconsistent data in procfs. The fix introduces atomic operations and synchronization in critical sections.

In the Linux kernel, the CAN BCM module has a data race on rx_stamp and rx_ifindex fields in bcm_rx_handler(). For RX ops subscribed on all interfaces, the function can run concurrently on different CPUs, leading to inconsistent writes, including torn 64-bit timestamps on 32-bit platforms. The patch places the assignment of these fields in the same lock section as the content comparison.