CVE Vulnerability Catalog

In the Linux kernel, the CAN BCM module has an issue with stale RX/TX ops after device removal. For RX, an RX_SETUP update could skip re-registering the filter when the device was removed, leaving the filter inactive. For TX, bcm_notify() did not handle tx_ops, leading to an endless timer re-arming and potential injection into a later reused ifindex.

In the Linux kernel, the CAN BCM module adds tracking of a single source interface for ANYDEV ops with timeout or throttle. Previously, when frames matched from different interfaces, races and data corruption could occur. Now the first interface that delivers a matching frame is remembered, and frames from other interfaces are rejected.

In the Linux kernel, the CAN BCM module lacks frame length validation in bcm_rx_setup() for RTR replies. bcm_tx_setup() validates frame length, but bcm_rx_setup() does not, which can lead to incorrect data.

In the Linux kernel, the CAN BCM module lacks proper device refcounting during CAN filter removal. Functions bcm_release(), bcm_delete_rx_op(), and bcm_notifier() relied on re-looking up the device by ifindex, which could fail during concurrent unregistration, leaving a stale filter. The patch adds holding a reference on op->rx_reg_dev from filter registration to unregistration.

A vulnerability in the Linux kernel's io_uring/bpf-ops mechanism allows re-registration of an already-bound BPF ops set. An attacker with CAP_BPF and CAP_PERFMON can trigger a use-after-free in io_uring context, potentially leading to privilege escalation or system crash.

In the Linux kernel, the BPF verifier fails to reset register bounds before narrowing the return value range of an LSM hook, leading to a verifier/runtime mismatch. An attacker could exploit this to bypass BPF memory safety checks.

In the Linux kernel, during fork(), the bpf_storage field in the task structure may not be initialized before certain error paths, leading to use of an uninitialized pointer. This can cause system hangs or use-after-free (UAF).

In the Linux kernel's sparx5 network driver, if workqueue allocation fails, the blocking notifier registration is not undone, leading to resource leak. This can cause system instability or crash.

In the Linux kernel, the dm thin metadata module has a vulnerability causing metadata inconsistency when a metadata snapshot reservation or release operation fails during commit. Direct modifications to the held_root field in the superblock are flushed to disk on transaction abort, corrupting metadata.

In the Linux kernel's dm-era module, there is an out-of-bounds memory access when the start sector is non-zero. The writeset block calculation does not apply the target offset, potentially leading to out-of-bounds read (detected by KASAN).

In the Linux kernel's dm-ioctl module, there is a potential buffer overflow in list_version_get_info. The code writes 16 bytes into a 12-byte buffer, which can lead to buffer overflow.

In the Linux kernel's dm-log module, there is a bitset_size overflow on 32-bit machines. Rounding region_count to a multiple of BITS_PER_LONG can cause wrap to zero, leading to incorrect memory allocation.

In the Linux kernel's dm-pcache module, the option parser does not check that each option has a value, which can lead to NULL pointer dereference. A malformed table can cause a system crash.

In the Linux kernel's dm module, there is a leak of the caller's thread keyring via the table device file. This causes the LUKS volume key to remain in memory after luksSuspend, potentially allowing its recovery.

In the Linux kernel, the dm_early_create function has a bug where it attempts to free an already used table when dm_resume fails. The table was already instantiated with dm_swap_table, and the code tries to destroy it again, which may lead to incorrect behavior. The fix skips the dm_table_destroy call in this case.

In the Linux kernel, the dm-integrity module has a bug that causes a leak of uninitialized kernel memory. When the hash size is less than the device's tuple size, dm-integrity is supposed to zero the remaining space, but due to a bug the zeroing does not work. The fix addresses this issue.

In the Linux kernel, the dm-integrity module has a bug that can lead to a deadlock. When dm_integrity_check_limits fails, the code exits with DM_MAPIO_KILL, but the range is already locked and not unlocked. The fix moves the limit check earlier to avoid resource leaks.

In the Linux kernel, the dm-integrity module has a bug where the hash_offset variable is incremented twice. The variable is already incremented in the loop, and the code increments it again, leading to incorrect behavior. The fix removes the extra increment.

In the Linux kernel, the dm-verity module has a buffer overflow in FEC calculation. The bug allows writing beyond the bounds of the lambda array in the RS decoder, which can corrupt the syndrome buffer. The fix addresses this overflow.

In the Linux kernel, the dm-verity module has a possible NULL pointer dereference in dm_verity_loadpin_is_bdev_trusted when the device has no table. The fix addresses this issue.