CVE Vulnerability Catalog

In the Linux kernel, the IPVTI driver's vti_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.

In the Linux kernel, the IPIP driver's ipip_changelink() did not check CAP_NET_ADMIN in the tunnel's network namespace. A caller privileged in the device's netns but not in the tunnel's netns could modify the tunnel. Added rtnl_dev_link_net_capable() check at the beginning.

In the Linux kernel, the ip6_gre driver has a vulnerability where CAP_NET_ADMIN is not required in the tunnel's network namespace during changelink operations. A caller privileged in the device's namespace but not in the tunnel's namespace can modify a tunnel residing in another namespace.

In the Linux kernel, the ip6_tunnel driver has a vulnerability where CAP_NET_ADMIN is not required in the tunnel's network namespace during changelink operations. A caller privileged in the device's namespace but not in the tunnel's namespace can modify a tunnel residing in another namespace.

In the Linux kernel, the octeontx2-af driver has a memory leak in nix_setup_bpids(). If any devm_kcalloc() allocation for BPID mapping arrays fails, the function returns without freeing the previously allocated BPID bitmap.

A vulnerability was found in the Linux kernel's legacy netlink interface for IEEE 802.15.4. The LLSEC dump operations in the IEEE802154_NL family lacked the required administrative permission flag, allowing any local user to read raw 16-byte AES-128 keys from the kernel key table. The issue affects only the legacy API, while the modern nl802154 family is properly secured.

In the Linux kernel, the ca8210 driver (IEEE 802.15.4) has a memory leak in ca8210_spi_transfer(). On spi_async() failure, the completion callback is not invoked, leaving the allocated cas_ctl buffer orphaned. Under sustained SPI bus contention, each retry iteration leaks about 600 bytes.

In the Linux kernel, the ca8210 driver (IEEE 802.15.4) has a vulnerability of pointer truncation in kfifo on 64-bit systems. Functions ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange a buffer pointer through kfifo but use a literal byte count of 4, which on 64-bit writes only the low 4 bytes of the 8-byte pointer. The reader reads 4 bytes into an 8-byte local variable, leaving the upper 4 bytes uninitialized, leading to dereferencing an arbitrary address and system crash.

A vulnerability in the Linux kernel's GVE (Google Virtual Ethernet) driver causes header buffer corruption when header-split and HW-GRO are enabled. The issue stems from incorrect indexing of header buffers by queue position instead of buffer ID, leading to wrong header reads and reuse of buffers still owned by the device when completions arrive out of order.

In the Linux kernel, the octeontx2-af (cn10k) driver has a vulnerability due to lack of validation of the base_pcifunc field in rvu_mbox_handler_lmtst_tbl_setup(). This allows a VF function to read the physical LMTLINE address of another function if base_pcifunc points outside its own PF space. The fix rejects the request with -EPERM when base_pcifunc is not a valid function under its own PF.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

In the Linux kernel on LoongArch architecture, a vulnerability was found related to missing dirty page tracking in pte_wrprotect() and pmd_wrprotect(). When hardware page table walker (PTW) is enabled, it may set _PAGE_DIRTY without setting _PAGE_MODIFIED, leading to loss of dirty information during copy-on-write (fork). As a result, a page may be considered clean and freed without writeback, causing data corruption.

In the Linux kernel IPMI subsystem, a vulnerability exists where the user refcount is underflowed during event delivery. On delivery failure, the rollback path decrements the refcount excessively, potentially leading to use-after-free or a refcount_t warning.

In the Linux kernel ESPINTCP subsystem, a vulnerability exists related to partial sends. Using sk_msg_free_partial() ensures skmsg consistency in each iteration, simplifying code and fixing bugs in skmsg accounting when not sending the full contents.

In the Linux kernel IPMI subsystem, a vulnerability exists causing a refcount leak in i_ipmi_request(). When a caller provides a supplied_recv message and an error occurs later, the cleanup path does not release the reference, leading to a permanent leak.

In the Linux kernel bnx2x driver, a vulnerability exists causing a potential memory leak in bnx2x_alloc_mem_bp(). If the allocation of fp[i].tpa_info fails, the error path does not free the earlier allocated bnx2x_fastpath struct because it is not yet linked to the bp structure.

In the Linux kernel liquidio driver, a vulnerability exists causing a BAR resource leak when cn23xx_get_pf_num() fails. The function returns without unmapping either BAR, leading to resource leak.

In the Linux kernel lan743x driver, a vulnerability exists due to using an uninitialized eth_syslock spinlock before initialization. lan743x_hardware_init() calls pci11x1x_strap_get_status(), which uses the spinlock, but it is initialized only after reading the strap status.

In the Linux kernel network scheduler sch_multiq, a vulnerability exists due to direct dequeue call instead of using peek and qdisc_dequeue_peeked. When the child is non-work-conserving, direct dequeue can lead to qlen/backlog desync and potential kernel panic.

In the Linux kernel network scheduler sch_taprio, a vulnerability exists due to direct dequeue call instead of using peek and qdisc_dequeue_peeked. When the child is non-work-conserving, direct dequeue can lead to qlen/backlog desync and potential kernel panic.