CVE Vulnerability Catalog

In the Linux kernel capable_wrt_mount() function, a vulnerability exists due to not rejecting detached mounts. If a mount is detached between checks, the function may dereference NULL, leading to kernel panic.

In the Linux kernel orangefs filesystem, a vulnerability exists where the directory entry size is stored in a 32-bit variable, which can wrap and bypass bounds checks, leading to out-of-bounds read and kernel panic.

In the Linux kernel, the mlx5 HWS driver has a memory leak when resize target setup fails. If mlx5hws_matcher_resize_set_target() fails, the replacement matcher is not attached anywhere and is leaked. The fix destroys the replacement matcher before returning from the error path.

The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus after entering Device-Initiated Slumber during idle. With the default med_power_with_dipm policy the link goes down and does not recover, forcing the filesystem read-only. A NOLPM quirk is added to disable link power management for this drive specifically.

In the Linux kernel's libata-core subsystem, there is a vulnerability due to improper validation of the concurrent positioning ranges count. A device can report a count larger than its actual log size, leading to read buffer overflow (up to 7704 bytes past a 512-byte slab) and response buffer overflow for VPD B9h when count exceeds 62. The fix bounds the count during probe and rejects out-of-range values.

In the Linux kernel, the iosm driver for WWAN modems has a vulnerability due to missing validation of modem-supplied offsets and lengths in the MUX downlink decoder. A malicious modem can cause out-of-bounds reads and infinite loops in the decoder, leading to system crashes or memory disclosure.

In the Linux kernel for RISC-V architecture, there is a bug in the rethook trampoline that causes a crash when reading a word from the stack in a kretprobe. The sp register is not saved in struct pt_regs, leading to an invalid address and kernel panic. The fix saves the original sp along with other registers, using a0 as a temporary register.

In the Linux kernel's memory compaction module (mm/compaction), the compaction_free() function does not properly handle the failure case of free_pages_prepare(). Failed pages should not be added back to cc->freepages for future use, as they can be either PageHWPoison or free_page_is_bad() and might cause data corruption.

In the Linux kernel, in the irqchip/irq-riscv-imsic-early subsystem, there is a fwnode leak on IMSIC state setup failure. The function imsic_early_acpi_init() allocates a firmware node before setup, and on error it is not freed. The fix adds a common cleanup path to free the fwnode and clear the global pointer.

In the Linux kernel, in the s390/monwriter driver, there is a missing check for changed data length when reusing buffers. A malicious user could change the length, leading to out-of-bounds write to kernel buffer and memory corruption. By default, the monwriter misc device is root-only, so practical impact is low.

In the Linux kernel, in the mac802154 subsystem, interface removal does not use RCU, which can lead to use-after-free during asynchronous transmit completion. The fix changes list_del() to list_del_rcu() to ensure safe removal in RCU context.

In the Linux kernel, in the octeontx2-pf driver, there is a memory leak of SQB pointers on init failure. The function otx2_init_hw_resources() does not free sqb_ptrs arrays on error, leading to memory leak. The fix uses otx2_free_sq_res() to properly free resources.

In the Linux kernel, in the llc_ui_autobind() function, there is a SAP refcount leak. After successful autobind, the caller's reference is not dropped, leading to exhaustion of dynamic SAP values and -EUSERS errors on subsequent autobinds. The fix drops the reference after successful autobind, matching llc_ui_bind()'s model.

In the Linux kernel, in the IPVS subsystem, the set_sctp_state() function incorrectly calculates the offset for IPv6 SCTP packets with extension headers, leading to incorrect state machine behavior. The fix uses the parsed transport offset passed from ip_vs_set_state() to correctly read the SCTP header.

In the Linux kernel, in the ip_vs_conn_new() function, the full ip_vs_seq structures are not reset, which can lead to use of uninitialized data from slab. The fix resets both struct ip_vs_seq members before publishing the connection to prevent TCP flow corruption.

In the Linux kernel, in the macsec_encrypt() function, an unset MAC header is read, leading to an out-of-bounds read (12-byte over-read) and data leak to the wire. The fix uses skb_eth_hdr() instead of eth_hdr() to correctly obtain the L2 header.

In the Linux kernel, in the dibs loopback driver, the move_data() function does not validate that offset and size do not exceed the DMB length, which can lead to out-of-bounds write. The fix adds an explicit bounds check before memcpy, returning -EINVAL for invalid requests.

In the Linux kernel, in the net: macb driver, there is a memory leak for outgoing SKBs that have not been marked as completed. The function macb_free_consistent() does not free these packets, leading to memory leak. The fix adds freeing of these packets during interface close.

A vulnerability in the Linux kernel's cpuhp_smt_enable() function causes a NULL kobject warning when calling sysfs_create_group(). The issue occurs on arm64 when booting with maxcpus greater than the number of physically present CPUs, where CPUs marked as 'present' are not yet registered. The fix involves checking the ACPI_MADT_ENABLED flag before setting a CPU as present and properly managing the present mask in acpi_map_cpu() and acpi_unmap_cpu().

In the Linux kernel's resctrl module, there is a double-free of the RMID for a pseudo-locked group. During unmount, rmdir_all_sub() unconditionally frees all RMIDs, leading to the same RMID being added to the free list twice.